28c708c285006d7661dc48594e70524e8dc37cba0f9dabbb48d0e52405403a3b

Resubmissions

10/09/2026, 12:55

260910-p5775atepd3

10/09/2026, 12:54

260910-p5p2jstepb7

10/09/2026, 12:51

260910-p3q6tstemb7

Analysis

user interaction
yes
max time kernel
1079s
max time network
1067s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260910-p5775atepd
SHA256 28c708c285006d7661dc48594e70524e8dc37cba0f9dabbb48d0e52405403a3b
MD5 9ef4c0108769f7cb92a906b6ebd70aa7
SHA1 7476fd1ab1a297ed9c95f0f457427ba970280cb7
SHA512 d7d846a916686251291feed01f755d0efb3febe541ba4d0b6368229470dfe6d49910b65efd1b30e667621a8b9ecdaa4ccdd5e63254ff2e1137a4fc35aa232f46
SSDEEP 98304:7+wgtlICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHRMfM66y:ElICteErownP0oTcMsABqlrX6
TLSH
T19D463308B3A809E1EAB3D13D85665221D972B4254BB0D5CF43AC97262F777D0AF3BB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
388	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335185858526365"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{5D667C09-4003-46BD-A43F-BF418F64A3E9}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4e003100000000002a5d1767100054656d7000003a0009000400efbead5c6ba72a5d17672e00000077e10100000001000000000000000000000000000000624e4f00540065006d007000000014000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5220	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
1300	chrome.exe
1300	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5060	chrome.exe
3888	OpenWith.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe
Token: SeShutdownPrivilege	4620	chrome.exe
Token: SeCreatePagefilePrivilege	4620	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
3888	OpenWith.exe
5220	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2712	388	cmd.exe	88
PID 388 wrote to memory of 3216	388	cmd.exe	89
PID 4620 wrote to memory of 656	4620	chrome.exe	94
PID 4620 wrote to memory of 4944	4620	chrome.exe	95
PID 4620 wrote to memory of 776	4620	chrome.exe	96
PID 4620 wrote to memory of 776	4620	chrome.exe	96
PID 4620 wrote to memory of 752	4620	chrome.exe	97
PID 4620 wrote to memory of 752	4620	chrome.exe	97
PID 4620 wrote to memory of 4668	4620	chrome.exe	99
PID 4620 wrote to memory of 872	4620	chrome.exe	100
PID 4620 wrote to memory of 4668	4620	chrome.exe	99
PID 4620 wrote to memory of 872	4620	chrome.exe	100
PID 4620 wrote to memory of 408	4620	chrome.exe	101
PID 4620 wrote to memory of 408	4620	chrome.exe	101
PID 4620 wrote to memory of 4744	4620	chrome.exe	102
PID 4620 wrote to memory of 4744	4620	chrome.exe	102
PID 4620 wrote to memory of 3976	4620	chrome.exe	105
PID 4620 wrote to memory of 1136	4620	chrome.exe	108
PID 4620 wrote to memory of 1136	4620	chrome.exe	108
PID 4620 wrote to memory of 3820	4620	chrome.exe	109
PID 4620 wrote to memory of 3820	4620	chrome.exe	109
PID 4620 wrote to memory of 2348	4620	chrome.exe	110
PID 4620 wrote to memory of 2348	4620	chrome.exe	110
PID 4620 wrote to memory of 2768	4620	chrome.exe	114
PID 4620 wrote to memory of 2768	4620	chrome.exe	114
PID 4620 wrote to memory of 3976	4620	chrome.exe	116
PID 4620 wrote to memory of 3976	4620	chrome.exe	116
PID 4620 wrote to memory of 4240	4620	chrome.exe	120
PID 4620 wrote to memory of 4240	4620	chrome.exe	120
PID 4620 wrote to memory of 5060	4620	chrome.exe	121
PID 4620 wrote to memory of 3592	4620	chrome.exe	123
PID 4620 wrote to memory of 4212	4620	chrome.exe	124
PID 4620 wrote to memory of 3592	4620	chrome.exe	123
PID 4620 wrote to memory of 4876	4620	chrome.exe	128
PID 4620 wrote to memory of 3180	4620	chrome.exe	129
PID 4620 wrote to memory of 3944	4620	chrome.exe	130
PID 4620 wrote to memory of 5316	4620	chrome.exe	131
PID 4620 wrote to memory of 3376	4620	chrome.exe	134
PID 3888 wrote to memory of 5220	3888	OpenWith.exe	136
PID 4620 wrote to memory of 1300	4620	chrome.exe	137
PID 4620 wrote to memory of 5388	4620	chrome.exe	138
PID 4620 wrote to memory of 5388	4620	chrome.exe	138
PID 4620 wrote to memory of 1224	4620	chrome.exe	139
PID 4620 wrote to memory of 1224	4620	chrome.exe	139
PID 4620 wrote to memory of 4644	4620	chrome.exe	140
PID 4620 wrote to memory of 4644	4620	chrome.exe	140
PID 4620 wrote to memory of 5304	4620	chrome.exe	141
PID 4620 wrote to memory of 5304	4620	chrome.exe	141
PID 4620 wrote to memory of 5932	4620	chrome.exe	142
PID 4620 wrote to memory of 5932	4620	chrome.exe	142
PID 4620 wrote to memory of 6016	4620	chrome.exe	143
PID 4620 wrote to memory of 6016	4620	chrome.exe	143
PID 4620 wrote to memory of 2752	4620	chrome.exe	144
PID 4620 wrote to memory of 2752	4620	chrome.exe	144
PID 4620 wrote to memory of 1416	4620	chrome.exe	145
PID 4620 wrote to memory of 1416	4620	chrome.exe	145
PID 4620 wrote to memory of 4904	4620	chrome.exe	146
PID 4620 wrote to memory of 4904	4620	chrome.exe	146
PID 4620 wrote to memory of 4912	4620	chrome.exe	149
PID 4620 wrote to memory of 4912	4620	chrome.exe	149
PID 4620 wrote to memory of 2608	4620	chrome.exe	151
PID 4620 wrote to memory of 2608	4620	chrome.exe	151
PID 4620 wrote to memory of 4008	4620	chrome.exe	152
PID 4620 wrote to memory of 4008	4620	chrome.exe	152

C:\Windows\system32\cmd.exe
cmd /c echo hello | echo C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo hello "
  2⤵
  PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  PID:3216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff6590c728,0x7fff6590c734,0x7fff6590c740
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,17161897550685718873,4112167948733813067,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6742179936839409262,1019693405422662348,262144 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,1972932686946939212,4116974506569580827,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,8995067911681455523,14135811986506756451,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,14470507435910934476,8478198591269253089,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,2858742380163945877,8590185754794087622,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:2
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,9825949875327344536,18021354642030570243,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,11336772905247118956,1785674936154795777,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5988,i,7287739425231302288,16865103360260084306,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4752,i,18125758208944836084,12132019019105186252,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3328,i,15661835636098499847,14949212816253242952,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5924,i,6972968306371282529,1059124663045856463,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5880,i,3485910484678996858,5622340713828594758,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3308,i,13900747202397309521,17847607615306087422,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,13404509300939618145,10470710280997200618,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6740,i,13632507622580638318,5522542109115163863,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,14233888982004493316,1225844146277216683,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,3349036706133950687,14854372821365248818,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,8397012557544977504,3670870917926599044,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,6024293819286421819,11592766874533258607,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6840,i,7324431107223581480,8269267778487993852,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6840,i,7624392013697242339,12546830192898237794,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5712,i,14763663135521982344,15831736289361865374,262144 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,208297289211429869,15708032311162336765,524288 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3412,i,2153496593613597321,14290576109725517630,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7124,i,4009891510610261653,8881905878850581348,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7224,i,5154062171038732136,4199921543229774750,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7408,i,987108899531614343,3366113187417105458,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7264,i,10639937315713867560,15844340968274744537,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7540,i,13864460745993630724,9552655942380395543,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7992,i,357278079196122208,11224204855965333692,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7988 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7596,i,2242653253905667433,3792629120397647601,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8160,i,15790032220336396855,4391969853356287969,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=1212,i,7297707697369728333,3198719151988796755,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7068,i,12973648871197023874,506206111314565039,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8300,i,5523963970869229500,7742133788166678744,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=8272,i,304520777962251682,498670672549636896,2097152 --field-trial-handle=2084,i,12742262679871796063,11367131561957025845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:1572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\cryptor.pyc_Decompiled.py
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  - Suspicious use of SetWindowsHookEx
  PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 311967da649dd54bd263b42f52f4d4730c62f0c5b420d49e5d6e8eece23b8acb
MD5 c464e9fa8c2d4c1bf2e52c7e3fcfabb7
SHA1 d1682335402548a3760dcaf097c87986bdbb473f
SHA512 a1df79b89a2bad3efd682df6d1cc6ccb535fc11b9d09ea549d3740a4d9ead0b4261a332fd95adb495c99a317ead4ac284eef3279389ffe9b6130c17d346c12d2
TLSH
T1BFE02B99C921EC371CFD4B2E54540A45EA6023571B61885F373C811C8FB06A7058A85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 2accf2a904e0e6f3dc139fd1e00ab07ca7bff8e2ab67a6fa5cc047e9ac5c31d0
MD5 82a734d892782b1a6c5699f6de28b247
SHA1 bfe5276faee86eb88ac42b1c04631a070b2fdcd0
SHA512 5202c394cef4853ecd8fc89e45993e2107c5f112f8aeb9b116db27c1d1de4d1d42ba551c283014140f96415c9f3ed1541aefc4d76a4eee0c22b92e71022f052b
TLSH
T107E086A4009035DDDBE44B7030D75993B171595755B71E530A88C7F47503FE51315FB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 4fdb81072b3c2855a6c4e5f1b547d0cdd3d5272e7d857778e8402da7e81ad6e3
MD5 e3152bc031423e94799febb88d7579f9
SHA1 36064640878d8c0e566c9c971e49cf55a3cf51c7
SHA512 7708c85e92f15c0610535665f50ee5aa2ba9853e4e5b134a932765dcea9bac7ea3a52cb9c93e6343c5fef9c8922b2c7ddb594e5c56819fd07ecd5c2610266d58
TLSH
T1D8F02296509031C9EFE0177834DA2C93B171181A54B72E930B8AC3F1B503BF2A305FB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6237aedd405dd47f6598fa26438a92b6b3ce530c979a9424ed2d95074ef91356
MD5 d7cd4a30341647ded65d02459a3d672e
SHA1 99d2e883c47cdabd8a3c3f07a6cb27d0d1c4f774
SHA512 154c01cb5b86d10924bdb7bbaa95188dfb988117df662ba67ec3567ad4d3ee13574f465f7f84115fc2376731e30cfcd2fa384f32adcab869fee5afd46e8010c2
TLSH
T1653103B0D0AA2889DB53177416EA6947743210D5B5773F32893AC2B57F837A1F705F50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 f092bc3d6e93da1e34fc55ab55ee49eed2199b1d47f746056b0aa50c2ba564b7
MD5 796873c5f54273994a09353106ecd382
SHA1 0452c6c96754f0608355d154908f97ad2a0fe850
SHA512 14d87167434a8288f8e2c6a65209c84d2917a533e1a2944161fe91370c2298fb534c9708a9e6f8341e560449df3fbebabe6d27381c28722c91224eff0ee1a520
TLSH
T1D8E05B9451D0714ED7C0537430D31593B1B45D5B91A71E474B80C6F9B503FE52315FB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 bd5f33e44e39581ef8941c0c292e4e3b23c31680589352ad00862d323ab53140
MD5 db5c6455c45ed8bca594c29f3530984b
SHA1 1752c05dc1d05b8080ec6b5b73819a796b841a13
SHA512 9a8b8cd03bdc55bae17a28dd2f50674b120b26afaaced3f3bbf16a1e9e6d4a94fa93bccec5322804451dbf917e09e06ca941bc5e3bbabd1bc718030d3ca6a891
TLSH
T16BF02B91508034CAEBE0177420D73C5372711816247B2E530B89C7F57103BF26305FB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 11ab97c687d394e3b4633625f557e5d59d4a684fd49c6b48ff2a56dc30287b94
MD5 5b9430927f19d5dbc57b72263744d96f
SHA1 99af36b7335a53fb0b562e10e69f3d84faeafba0
SHA512 ffff866e73c202904794d7b72f4f4c39a6a6308a34f74847c4ce55539fd0c258d49cbd53decee13df28021fbc11c937eacefe357e380465988ed5d134f4e4ac6
TLSH
T11D112EB0D0C72496DB970B7424DA6883703064D521A73E271A46C7F27DC3BE1F308EA0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ea486ae5cdd38d3d51d161b8f528be35f8746d88bb31211efee89f7cbfc6f41f
MD5 de7e9a5085505e2fa276a6a89f2ab700
SHA1 0d548f4f82ab4116e90bdc1ddce5edcf9c864d7c
SHA512 d48215810151909582a587b07cc45f886ef74156a48aa468e580e13971077a025e09229f033a87a0ddf69dce82fa7f84d28e6c3278484b3edb8a34ceb09dcc24
SSDEEP 192:DXBieRzaI2liEe7nzinQnNn1nmn4jKjAIjhj/j9AjM5VElfzrUFo4/c4c1t:DXBieRzaI2liEe7nzinQnNn1nmn4ukIK
TLSH
T1EDF1A1F7C3E49A2D8D2156F5A7142E1BCD290D14532C3D66C9E9EE8BA3E3870E24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 46e2bd8a26087845e43c3620a18d3e904d4f4ef3ca189c4855a452d6a626c631
MD5 0973697963d689fb93dc5bfbb1a1991b
SHA1 ab2b385b1c2056d841d5fe1ed61a26e702786a3f
SHA512 1486cd99f2968cb9e5a0dc2d3de78a03e87652ca07d4b06541e66397d3909fc3b4b1eddece2f37145d93ddce0a71711cba5e3cb1d78ac6dbc21f1f151bd6c5e6
SSDEEP 384:DGNLehwbJNk017klZ34SaI2in1ukIdzpA3NzrRFoS7cs6fgM/dAIiEdVoLQ8knDv:11F1Cznv
TLSH
T17E42C2F7C3F48A6E8D1152F4A7246E2BCE280925432C3D75C9D6EE4BA3E2471D141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f75312afbfa56abcbda40d40ea3a212bed19bd4af778972474531fb21754c046
MD5 6663c2d23ab7499c56360402ac101f79
SHA1 c0f1421d8563ee7fbb905d7c72da7130020d2e7f
SHA512 21358f0ca0633f77eeb1e4048538533b6c8769e3c06519a3530002ac9a74d80a09451d50f9f4d6de49ea587f75bb301be50f14a61fa005a0606514c96c84c968
SSDEEP 192:DGNLehwbJzQFazX9aI2in1jKjAIjhj/j9AxVBfzrRFoS7cs6fgM/dFbilnVvLQ8C:DGNLehwbJzQFazX9aI2in1ukIdzpA3Ng
TLSH
T1DF22E1F3C3E49A2D8D2152F5B7246E2BCD280D14532C3D66C9E9EE8BA3E2471D24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 346ad34a4a072075d9468992ee5e8a5d898ed6c3eb95f1d277e633bca4189e4b
MD5 c8dfe9a398915c3c8179731a851650cb
SHA1 4d0e5efda73c6a36ce3b3cba92ff4bf2078f7750
SHA512 5bdbce2eef892f32885d38125a4c5097fc1fad6aa00d7ca177bd134ff02739d2bff3d37fcce1149ffae9d29bf8f8e4f34cfa41de3acb12c15f530b5090289e32
SSDEEP 192:DGNLehwb4zQFazLaI2inzinQnNn1nmn4jKjAIjhj/j9AxVBfzrRFoS7cs6JgM/dQ:DGNLehwb4zQFazLaI2inzinQnNn1nmny
TLSH
T13022D1F3C3E49A2E8D2152F5B7246E1BCD280D14532C3D66C9E9EE8BA3E2471D24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7b22dd60a8c925d00ccc1b42c0920b5d5e02198de49d4947af0adc9f5b2ddd74
MD5 1636e08b2911f058ccbe5347feedb5af
SHA1 644819d8ef53791a38efc84dee6e24ce1dae63e9
SHA512 7759ec934a9bd7d500c835b27e3e1b6965d1ace4bb693e8ae9117e9cd16b33ed70c9fef7713a682061fb1e46f71aa06f9fb95912b9319cc258f6a6fbad6f5e49
SSDEEP 192:DXBieRP1EaI2liEe7nzinQnNn1nmn4jKjAIjhj/j9AxVBfzrUFo4/7cvuDJgM/Yn:DXBieRP1EaI2liEe7nzinQnNn1nmn4uA
TLSH
T1EA029FF3C3E49A2E8D2156F5B7146E1BCD290D14532C3966C9E9EE8BA3E3470E24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 931cdab472d23201cba286b8cf84bf32943cc93d7d3454f1a86e9f3187fad1fd
MD5 ecf5ee999bbde0214a42564b2b5ed888
SHA1 052e1f15207e847f456b4aede79de4e30343746b
SHA512 640f108d0678a00a47d026c3989d4753bab4b343931c13d0e063fd66cd617ddf6c01eed08bb4de89ff190b9c1e77ab2f3db33ca23cbcbfd80b19fccc68f15b50
SSDEEP 192:DGNLehwbJzQFazX9aI2inzinQnNn1nmn4jKjAIjhj/j9AxVBfzrRFoS7cs6fgM/e:DGNLehwbJzQFazX9aI2inzinQnNn1nmI
TLSH
T11322D1F7C3E49A2E8D2152F5A7246E1BCD280D14532C3D66C9E9EE8BA3E2471D24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b00075f3d6d65ab0fc27f6f7e6c6a100346789e87cfe906955ebda460d907b45
MD5 5907e643613bfd6d4817c8b6fcf5648c
SHA1 34162c6c4de8d2f3178e0f3568156ce1d8175cb7
SHA512 944975d4812ad9a40a336a05d32788a0ac224bb1429539a28f27233e627ea29e6bf0fb52c827e2e15532afd178d75491537ce6074c64a6749dd7d42ae08f9f16
SSDEEP 384:DGNLehbJNk017kFZ34qiaI2in1ukIdzpA3NzrRFoS7cs6fgM/dAIiEdVoLvknDn7:Z1F1Gz90o
TLSH
T11E42C1F7C3F49A6E8D2152F4A7246E2BCE280925432C3D75C9D6EE4BA3E2471D141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 681fccd01cb72cb134a5f81a1442dec8e8f6b8ea3921d937606d8cc03970ffe9
MD5 6f0a0966b68af4b66b22f27d15aaee49
SHA1 efed0f0eebcd5c4868f5faee65b57cf1f8ec1d8e
SHA512 f150d9bbd7b285ed39101a84b790a0a763d8564660115bc6dd498a17e2195f06e2a2824812339b4f4267640191f752991e698d25ec6f2c4bafb414ef0148ca60
TLSH
T18F21BEAB857EB59B107A48BF1E44780959B6BC30099178F4CBDB836CB0819F76F13017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 918a412a70090068bf6410d3437523731281a577efa860bb131b82a9947f576e
MD5 31a6ec7d816b7ecf208dd834db858281
SHA1 de4b4ca564f8869184e85b569a1d554c15e35ba0
SHA512 1bc872e0fe0bed55a176ae9edff083fd78e94805ba360b4cad3ea088516fb8b609cee7fcdb384c866082ec63ea12d111505c3dd0f23eb0b0150fbe519aa3d063
SSDEEP 192:XRCyIUg8t/Ov7rhAPRp2m7m9qHsb+WNnmlqKx2Be2aUkwAabVyIsnAUgraJ:XRCynXqf8XQkwcx2c2Pgade
TLSH
T1F652C92EED10797B9CE7D21AFA167713E7F9203525942E84EAFC892C29E75CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0e534af1b9e3342d6c577329633470ee57c962e705c31c9f4b347b9cabd7436d
MD5 f92d1d61022d49646d54c0e38399e5f8
SHA1 740478d502efa5772375aec8b60acc9a2e199ae4
SHA512 2d2b2b25e2fdf09d20c9a9976d3f2ed7d05a2c6be6160521696e012d7d86ad888f8de98ec8042319ff87dac6ad068b25583289a7425068565b91fc6ef4e69441
SSDEEP 192:XRCyIUg8t/Ov7AhAPRp2m89qHsb+WNnmlqKx2JPe2aUkwAa7VyIsnAUgtaJ:XRCynXqk8XOkwcx2Jm2Pga98
TLSH
T18042B82EEE10793B9CD7D21AFA167763D7F9103525942E84EAFC892C29E75CC211B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d8b115b5f0e03f5113a0247e3f7c6fb8cf5549895655d5d05133b876505ca972
MD5 185bcd6695bc77c56ea8859bcfddfec8
SHA1 d569ded0359a7e8268bfd6c138f31ee668cb0a8d
SHA512 4c39c057319e1a77e2297e991d6bbd13549752708e7d542b165113ce77b36e86005580a761df4ab784cb1e47d277e2d0a187b679a40e083f17b22cfb7ab12c7d
SSDEEP 192:XRCzIUg8t/Ov7rhzPRpnm7m9qHsb+WNnmlqKxwUrlrI29e2aUkwAaNVyIsnAUgrK:XRCznXqfBXhkwcxTC2I2Pgabe
TLSH
T12252C72EED107A3B9CE7C219F9167B27E3F9203525942E84EAFD892C29E75CC6117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a1941f98f8ef56f65b767b450e03512076a9034d8f527a5d4321143c2fb42bb1
MD5 4614eb2a4c4a3fa83812c6e75d417aa7
SHA1 5a5857e6f3c7e013a451012c51d3a10e6322756b
SHA512 c46202c8ac619410ba7a943514a6c240e6eb8077e9b42279ddbf6dc43ad9cc050b46abec199f692d0d5372e40f7c6821b92422b41052507c8ef98bc03b62ff4a
SSDEEP 192:zRCT8SHfUg8tIRv7rVzPRpnn/kvm9qHsb+WNnre4bJ/3LRYUrlrI2He2aUkwAaNN:zRCT5MABf9XXkwy4l1bC2+2Pgaae
TLSH
T19F72D72EE9146A7B9CE7C229FA157F23E3F5103626942E84EAFD891C14E75CC7117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a2944693e3eef98773506178e75b34927b0f0595f49a6150b3b60de27c31ed93
MD5 645c0bc47270260da5e89dc47f5741a8
SHA1 112a96df36706591bed2ca7cb0d7e6dbbc86557e
SHA512 75371329b05f59ecfdeb8eedef2717a309253c9597a4c5b3bda8c9db7e1932e725369062d3a40d2357d1055f1d0c916fb928b03e270fa19fd97194c2f94f3fe2
SSDEEP 192:zRCb8SHfUg8tIRv7rVzPRpnn/kvm9qHsb+WNnre4bKxPLRYUrlrI2Ze2aUkwAaNN:zRCb5MABf9XXkwy40NbC202Pgaae
TLSH
T18E72D72EE9146A3B9CE7C229FA157F23E3F5103626942E84EAFE892C14E75CC7117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 faedfaaa768ff0718d83e17b170b2dc7c480c366b2ba1b59d7c4c72f9e9c9444
MD5 43e8b4ade61bac4b7bc139f2fc3dfcac
SHA1 7683b9786777c128f99bc411185a4bcf0803198a
SHA512 492fae46f1a496d537bd40cd89c3f749416b1aa00a485e5e804a0f5b0778f646ae6c97d00e05c500299ee8da4f6d99990250fb950f397fb91644428582f8e71f
SSDEEP 192:XRCaIUg8t/Ov7rhAPRp2m7m9qHsb+WNnmlqKxwUr2/e2aUkwAabVyIsnAUgraJ:XRCanXqf8XQkwcxT2W2Pgade
TLSH
T1B552C72EEE107A3B9CE7D219FA167713E7F9103525942E84EAFD892C29E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 89c50e520f803a5a1501e3c99b7083fc45afa13b05da670f2ab90c1a3907cfac
MD5 92bf4c5591dee512292b7a0d18fca3a5
SHA1 5340a22e036277627ae0fd0ec60e3333595f3cc2
SHA512 e3e797fc70ac946b31c071e2a4f069e183f42834f54d76c7e4fe9c06d6f4ed2daa4e1926d5ef29f5db2e8ae2e7a802de33d48ee97c803036e21dff118c3c1ccf
SSDEEP 192:zRCb8SHIUg8tIOv7rVzPRpnn/Avm9qHsb+WNnre4bKxP/MeUrlrI2te2aUkwAaNN:zRCb5nAqf9XTkwy408xC242Pgaae
TLSH
T1A672C62EE9146A7B9CE7C229FA157B27E3F5103626842E84EAFD892C14E75CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 187404a04319745e6982aa3e9fc7637ae31a4a4914be1b8d600952284c39d432
MD5 6d6c237813fe44781edb9c4d119bf210
SHA1 6ff1e352b17fb052c919f79494071f8a5582d70a
SHA512 e6f89d399e53e1dfcc0206c547b1b02d14377128c08c1101febe41cea8e776e5acf4faee56a89540da504a0d373cb0ef9ac08d9f05aff3df7a73c258e01be7a2
SSDEEP 192:zRCzIUg8tIOv7rMzPRpnn/Avm9qHsb+WNnre4bKxP2j4wUrlrI2we2aUkwAaNVyr:zRCznAqfgXTkwy40O4TC2j2Pgabe
TLSH
T11E62E72AED207A3B9CE7C229FA167727E3F5103565942E84EBFD892C28E75CC6117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 2c4df105d61b97a768568ac1bec72e7036c947d3e00885d03f6ee4e79a080029
MD5 215bbb1eacc50f599f596e662ccc6f4f
SHA1 1a0111e6bbfbf139502daabc7d01ee1dffa10400
SHA512 4e24ea6fe5a758a71d239d83b139f3fbe73d58cf0377e8c6f5d0c42d0c37c2bc0118a7cfd54f7afb656f1845a91043a1d72690108ec9c0f8672e610147c903f1
SSDEEP 192:zRCT8SHfUg8tuRv7rVzPRpn2X/kEmm9qHsb+WNnre4bJ/3LR3w0cxUrlrI2le2a8:zRCT5MGBf9Xskwy4l1npC2w2Pgaae
TLSH
T1CC72D82EE9146A7BCCE7C229FA157B27E3F520352A942D84EAFE891C14E75CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e95af6da53cdac7e0f3f3a8a662e96b933e62909c39ea07028b14bb5fcf67f9d
MD5 f93b655b8fd4ebe8b487858519024fd7
SHA1 3a7d0d270d444edbc6687e39fb65d25c78de024f
SHA512 3cb5f727eb2334adab37cd8e15e32b517b7e25503b8924be3a504dd00599753be34bbccc811bf7b3a09573051da6bbda45a71fbf7cb135b12abcdbdca41e9be9
TLSH
T1FEB0125185C17101C0020BF4114314A87114AF10A60A170183E0E9668925165D139165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a718.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a718.TMP
Size 96B
SHA256 9e6dcc8e1cf0020667f33336469b1589b9bcf7aee37b81fe7c858d476d55a394
MD5 91658e257e88bfd0ded4f28d51bdae94
SHA1 e3b63ae36a25162a57eeef463b2da0eb0b276329
SHA512 fdf93353eff3ceb3c766026418464a4178239670337799aace3050d6fec0bf26386b077b111175b439fd575b8a1774d19631214aba78ddd91a2d755c3d863aa2
TLSH
T1F7B02200C2022203C00203B0288080C832A0EF2CCB03220282E22BB3CC20A2000203F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\8cae0d10-2df3-4a9f-9b63-cae2d9c2cbda\index-dir\the-real-index
Size 72B
SHA256 24da55fc27ac6ba37af58ebd7a3bd2268cd595a678c5f7929e5e184770fe9890
MD5 cd620cfd98d51101e0e6ae89a55705ad
SHA1 3f959eed9726675c99733a0133b80c2453c6dca8
SHA512 00714a8bc2ce9383c9138d4a3f7f7c747a5202e85c6c64ad96d32d6403a44b5b17319c30813a85b627b259ae40865d6894911675a758dfa86e5056178e539369
TLSH
T124A0022851501702C46457702467217633394A11FE15025282D1E2B4C9921E5810723C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597e2f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\8cae0d10-2df3-4a9f-9b63-cae2d9c2cbda\index-dir\the-real-index~RFe597e2f.TMP
Size 48B
SHA256 4f65550c7dfe666d2db6287eddd9e137b4b32cb6f63773f063d85a165f7755c0
MD5 a1cd91f3c1006c5158943431d1a2487c
SHA1 cb83fbbad3ee5473a5b580c28fae01d7006d0a68
SHA512 ec617d951317645fe2914fb0fd16b6460c31dc844ed53af0836d855721dfe1ccb8d4e070a867abd784709fbc39bb461fde9e89dde50a24b447bc61a082a22339
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 236B
SHA256 cb7ba6473f004113ac644e5449945c090a65c9155dd5830a289cb992cb79cd73
MD5 dcd3c68f111dca05361bce5ac4faec1d
SHA1 dc09f7628b58908fa317d597594f4b1a38d6dacd
SHA512 cd788292ce2ef8c9b604273533c562341ad8015bb670e43072c1227b5a12f58d8e62fce8fed1d0f606181159c2010d112c9d839172859ad490db9b95766be6e5
TLSH
T1EED0A7DB513049092770AFD62474664DC0178D459CD0DCE4C848719634BCB22D112D70
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 fa2a7ac30f89ee05c5bf0c1207df289e2a499b9eb21d8cd8df7832df0a581a6e
MD5 2c571a2ad306491f4933744d75e8f170
SHA1 7bd23f99d6e1f3c38d99ba791618e97491d56250
SHA512 8887fc270c5fad767cdb837e9a365a68385af2dfa938906b0c2e1f6b61f913fb52bd8c72a2eba5c4af8a3faaf0e6fe67e2a0970ec47ea4854316839d780c91d1
TLSH
T180C08CDB14104A4A0770AFE620B87B1DC10B82088CE0CCE4D4487051307C8228402920
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 153B
SHA256 fdd7d15afdf7f00e755ff097034bc45e3ec85e56924d11a6be41ece4e85dc448
MD5 15423ab721e0c28c94b59d7d12d4015a
SHA1 12c4d212de26e50c371d2af02ce466cea097aae7
SHA512 9315dd433ac9c789f8b793354f9f4d4dc3f86562812d28ef7d8897064edd9c68b978865025dafc0336d3a62adc2038e892561f3f2a10191a8b965911cb7b4d1e
TLSH
T1A0C08CDB14104A4A0B70ABE620B8770DC10B82088CE0CCE4D448705130BC8228802920
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b6d8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58b6d8.TMP
Size 159B
SHA256 40240da7fdb5b24f429c6caf152c5e7a27d96a02cc110bc68e42ad94e1269a3b
MD5 21f282235a3e572d3d38624f88ecf5fa
SHA1 dce6a28366080e1774cb5ada180fa7e654341a1b
SHA512 8af37e3961e5370aa3d1124e022833fa5138eb9ce0db40b892a6883bce623101c6335d7b1ba9ad728b7aede8c45ba00d3601b9f38d08cca58046b9318a74de4d
TLSH
T1A6C08CDB14200A4607B0AAE22078770DC10BCD098CD0CCE4D448B052307C8238201920
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 ec7c7126b933a653ad2a298ec4ce4e75ee171c25ccc951c0bfedfc88ae675420
MD5 dadd019db4f7d69410ed13867c11ceb3
SHA1 d264dc205caa8c70f8939cb0b9729564dd8eaa52
SHA512 83553346f927121094d892971237fe0b6eed31a39c72a3b4d621db6e0f4a499dd997a4bf23ab7fef14b9c7dc0cde4fd2b11cc1f0114580e8db56d621d86032f3
SSDEEP 6144:7PQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:z+38eiCx9oBGcAol
TLSH
T18134227B6D90E93B49F78F6EA44F1F2F2DF25682DA10CA8498D43E05D599B804C4BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 9a19aa56648609249c7704ad7dd897e32a89ca9458a97bf5136b81da46de3827
MD5 c4e8dbc125d6143c8617a03cdb76c79e
SHA1 ffa4eb9681d6a4f584bd028f65358027bafaaa0f
SHA512 e3d088a1f031334f3f7ae2f01e272c396c0ed687624326f2078c111cb50131fc6d457f06a7eb9385d85b80a37271191c09d19f731667b469a5b4a81caca2fd90
SSDEEP 6144:mPQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:Q+38eiCx9oBGcAol
TLSH
T1E834227B6D90E93B49F78F6EA44F1F2F2DF256C2DA10CA8498D43E059599B804C4BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 55fa8e3166dc30b19d3adba99924b51fe4f189779e48ab689bae95128b1ab809
MD5 3149216f860bb95771c01142834a9ade
SHA1 2bd138f7090a97f445dd66cdd4ebc5df0d79aba2
SHA512 52970d48dcc7b174daa832863f98353c14826d443ffdd05e59db55b72a7fa05635bf51890bb71aa885d0473a9dc1838ecaf0e50c3a9f67f509ffc1a3ceb406b2
SSDEEP 6144:yQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:y+38eiCx9oBGcAol
TLSH
T1903422676D90E93B19B78F6EA44F0F2F2EF356C2DA10D6D188D06F059598BC1094AF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 ed9b9a2e1c0d697d03f41a2529f3097ef67c209b37b29e16e14caafa6b938a0b
MD5 172192f3e1d02f705516d0b36f9cfcde
SHA1 f859f1887d94a8b3abfc68fad9a28f15ba0eff85
SHA512 8be2e026a6721d631135d49b155634c47b94858647ad9f516e55ed4f71b987518436a500d37e6a1338fba86ad7865b60cc39fbb693b2770f4bfc2f7743063dc6
SSDEEP 6144:JQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:J+38eiCx9oBGcAol
TLSH
T1423422676D90E93B19B78F6EA44F0F2F2EF346C2DA10D6D188D06F059598BC1094AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 7e9bbf7be1516f33646efd25f8224a4ffa6201b0a3ec1d9bc608a58f216c2cfa
MD5 71f26b7710ebbee15cac710eed014d89
SHA1 9f7f94317b23a0773a7e11fb4dc70538968b565c
SHA512 4ee9310ca82cad73756ab88f6567c4218867829c33708f57f00967a024bf8198532312052d1c52a5ff49d6b9abcf1bf3821fbd982a5368def748a04e960b0c41
SSDEEP 6144:UQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:U+38eiCx9oBGcAol
TLSH
T12A3422676D90E93B19B78F6EA44F0F2F2EF356C2DA10D6D188D06F059598BC1094AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 c7d3aca9526d9af960d6f05645d13482b922d5dd901d05c2e47ccde21acc439f
MD5 0d61384857c541acc49b3c33ca70af3e
SHA1 575ef14b594564b477ac251456482bfba9bd7797
SHA512 ddeacf8c9373d161af1859c2fbdc4e685976c3df72e93cfa27e5296c72d856554458e1745d966d83c1afef3434bba181fb6810d948948d9c13e4fd756e90983a
SSDEEP 6144:DPQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:b+38eiCx9oBGcAol
TLSH
T1E434227B6D90E93B49F78F6EA44F1F2F2DF25682DA10CA8498D43E05D599B804C4BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 32b12f7c234c9941215e0c5b937e0f5cd2b2db231050cf72f0b475defbbe123f
MD5 b1a2d44b4b06b55d2c2bbeaf0b8d8a6f
SHA1 59c7b7b4205348ba827aac8a4fc08f742b77382d
SHA512 9184c750ee8d8d594b04c3feca36a209e22fc7773e84936eab24ceffd788e6a837f0da302ecf49eb6189230438a691d271f7b0cafbfe471fbf536bfeea5e69d7
SSDEEP 6144:0PQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:2+38eiCx9oBGcAol
TLSH
T15134227B6D90E93B49F78F6EA44F1F2F2DF256C2DA10CA8498D43E059599B804C4BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 b082a6980be108182503bd45cdc1fb334822c19c66fb934311dbdec02acf601c
MD5 8ebfa55908d7785135606d4c5084166b
SHA1 06e70b739b8032b895b5fe6f4aa837ece4bc3d72
SHA512 4bc9b25b7e0476917fa60347df331472dfdda6011e21a3bcf4cd24cba797f34d51f1b4b7a2abbe539ceccc3633d1c31f1aa66c62953c48fedb53a6442a19a852
SSDEEP 6144:NPQ5tTbRIn7e2f7vwO6Gm7Rkm1tYpBeh2BAol:F+38eiCx9oBGcAol
TLSH
T17034227B6D90E93B49F78F6EA44F1F2F2DF25682DA10CA8498D43E05D599B804C4BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6f5cbf6900987d7d34fb27c556f10d447752841fc6fb698851d948271abac5c5
MD5 6d21582bbb6ee1e8e7ba36e18009c94b
SHA1 6766d5c1d85920baf57d13694c73f5fa7512be0a
SHA512 7a7af6b61c5a42d4b3f4be4f96946399bc93dec67f821a122b1d2dd5d436489efe666cf0953d2e5d28486ec4a00fe9ba03aa327653f4105d61673bd033be8ef7
SSDEEP 3072:AYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:0m7Rkm1tYpBeh2BAog
TLSH
T120C3023B9D75EC3B5CB5A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe_extracted.zip

Path C:\Users\Admin\Downloads\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe_extracted.zip
Size 12.4MB
SHA256 9706b6f5728d2584eb62c46ec2e87d46c8272ffeb251dfe117a3673c70aaede9
MD5 9aab3469fa01aca7c8a68f332029b00b
SHA1 20460ead41cebdbdfd10d459d576fbb1f56cf053
SHA512 7c6364c93a1633a17f762eef643513353c5065572b26abe8be0abe459be111e114d4fa953cb64442083fb82cbe222aec37832d7cd4a89cdb0f4302be695d93c3
SSDEEP 393216:3o9Z+Sb11i1CPwDv3uFhL3U2lvzBhWrVeBv2pIqB:3ZAZuIqB
TLSH
T151D68C12B6A00896FDB7F1798057461BDBB2BC245720D7CB1065B2A92F377D31EBA708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cryptor.pyc_Decompiled.py

Path C:\Users\Admin\Downloads\cryptor.pyc_Decompiled.py
Size 21KB
SHA256 771400988ba699a6863fd4f2e3db398ecdf60726676478d7339aad22c8c8b992
MD5 75bd4e3cc844917927ff140821b35e58
SHA1 b02f4da02c4763092570c8c804f66931d6e920cc
SHA512 cf86d78e0bed2c5be0febba2f9ee3cf923ca18f449be6b6c7f40bb4f4145bf8129be5c6e18c31ea8ab69ae304c598ed1d9b8f337ade710264d0906f8e4e5929b
SSDEEP 384:OUrfiVFZAm84VaiWZ2p0kdS+/BvmydP+R:OUraVHAm/VdWZ2pnYymR
TLSH
T133A2C5AAA8742C76C353E66C4523E40137463C63E8465538FDEC87A07FD8634C2BAAF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download