Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
kian-shark.gif
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
kian-shark.gif
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target kian-shark.gif
- Size 281KB
- Sample261011-vgbf5styht
- SHA256 c0cefb53b4186a684d4f83c7f970c781b7089ce1a0b294cd65bd1067d0de7b4b
- MD5 3b54a2ce113166f6499a54df2291de1c
- SHA1 afe74faae7e3b2fe0b2467c830d255181c2b15a8
- SHA512 b803a90b79d6e3ef7cfc74f461c19673ff00f17571e0d5ea3f3818fd11548711724f87b2c5b784520d0e36f9ab96dc7ba670feac7e7a370e4e2fa400ba39067a
- SSDEEP 6144:zvFnG5ucdc9DEhNd6ZErAeLgA6iFl/Y5ZD/PhwQoEHObwV:JnjVER6ZErADA6P1hwQogOba
- TLSH T1A6542376AEA906FFD7D2A4E44C09C3C546F04EDB232068638F1DBA8794569056350EFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2540 chrome.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000008caa2ce16901bef7fed9daf51fbfb37b914f7678306980ca85570aa92e01e812000000000e8000000002000020000000d4c2070dd921ecf1871b7a60a466e99023243b1409af45f4e0acfdac95d879cc50000000fdf0848ea7498f73f80373787c90ec9ddcf072c0227a2f6069c27ec2e4f90fc24f69554b6e93d724e1bd7897b03e090a72b24e05cd512e3a73e7e695059409c548e7a52897c01e44bd40b364967a6d334000000035047c902b2485edf26ac44c6d70326f040e354f9d2cfac80c4aab57bcbbdc15d2d1d0324adbcc5f2e066314731921201950bbe4cdc084e91d54105c2d6c7f8c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2885510682" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000008b4cbdea87bf7df722ce874b461011588857544ff7568c5e7c019aa523331ff2000000000e80000000020000200000006b3af360e0518f489b9d83bc375671e0c968d6b670c8c2eb61699bc233cb5f2320000000b6e94191d893e50ebae568eb4cf14aa7496d46b3bae38379145a37b0e389dbf140000000ea65f1ee04160f114d327d056608361949c9d77fa8b7e858bcd1107f7ab55c414ae0188c1a406b3479a3ce3995eed56333de5a7a1ee6136ddab2d96d2fdc0c07 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283617" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cc690eaa59dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000e50c35a9880be6b3d4d1d8308c084975edb06638bed5ec122c0c0317b8b66d3c000000000e8000000002000020000000bc0a8ab8eb6f8530f63e81358772e83695e03e1f867c71eac06f6d02d328034810000000e30e7c24bd4ee741a6d8d268b840bc1c4000000007fe716c363f7245e0494cefdf5f65c02fc28c221faf17e721f4be76c6e2f5f8004a9b777754afa3330ac823bbb139879f02fb42419fbd875aa7c1c164251d9d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000b7e19c3512980f5314127f7661dd00bb9987a0effb39a0b64d62d31e45842955000000000e800000000200002000000005b8f51f8a7f6293570f7cbecccac35870f4d597c7e930c34e13da1c18b42e5a20000000cb218ba8f21a500918b04e880636456e99bf90a0ab9e8f0bac57a0ae90f47afa40000000d45884a0d5e1ee8c658ddaf82714512450e152ddc289446c106ebb8df52a198a1f9113ecedf54e603767a18e80e36f6ec574752e0c4abd08094395ddcca3182c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02f600eaa59dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D6C5E578-C594-11F1-B7E7-621E4F736A29} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{CC761BF3-4DF4-48EB-9212-563F810B4F00} chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 5992 chrome.exe 5992 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe Token: SeShutdownPrivilege 3360 chrome.exe Token: SeCreatePagefilePrivilege 3360 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4880 iexplore.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe 3360 chrome.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4880 iexplore.exe 4880 iexplore.exe 4676 IEXPLORE.EXE 4676 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4880 wrote to memory of 4676 4880 iexplore.exe 85 PID 3360 wrote to memory of 620 3360 chrome.exe 99 PID 3360 wrote to memory of 2540 3360 chrome.exe 100 PID 3360 wrote to memory of 3368 3360 chrome.exe 101 PID 3360 wrote to memory of 3368 3360 chrome.exe 101 PID 3360 wrote to memory of 3348 3360 chrome.exe 102 PID 3360 wrote to memory of 3348 3360 chrome.exe 102 PID 3360 wrote to memory of 4860 3360 chrome.exe 103 PID 3360 wrote to memory of 4860 3360 chrome.exe 103 PID 3360 wrote to memory of 1504 3360 chrome.exe 104 PID 3360 wrote to memory of 1504 3360 chrome.exe 104 PID 3360 wrote to memory of 1668 3360 chrome.exe 106 PID 3360 wrote to memory of 1668 3360 chrome.exe 106 PID 3360 wrote to memory of 4656 3360 chrome.exe 107 PID 3360 wrote to memory of 4656 3360 chrome.exe 107 PID 3360 wrote to memory of 3556 3360 chrome.exe 108 PID 3360 wrote to memory of 4260 3360 chrome.exe 110 PID 3360 wrote to memory of 4260 3360 chrome.exe 110 PID 3360 wrote to memory of 1444 3360 chrome.exe 111 PID 3360 wrote to memory of 1444 3360 chrome.exe 111 PID 3360 wrote to memory of 3340 3360 chrome.exe 113 PID 3360 wrote to memory of 1456 3360 chrome.exe 112 PID 3360 wrote to memory of 3340 3360 chrome.exe 113 PID 3360 wrote to memory of 5388 3360 chrome.exe 117 PID 3360 wrote to memory of 5396 3360 chrome.exe 118 PID 3360 wrote to memory of 5404 3360 chrome.exe 119 PID 3360 wrote to memory of 5992 3360 chrome.exe 126
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\kian-shark.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4880 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9a6ac728,0x7ffa9a6ac734,0x7ffa9a6ac7402⤵PID:620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,4911251604780959457,6038091794337085543,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:32⤵
- System Time Discovery
PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,4550507595320219772,2305663127039210050,262144 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,6298891220325789206,13464293388445394279,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2412 /prefetch:82⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,3398782387263271618,8412530582211101049,2097152 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,7521105980234430253,16928569773738708368,2097152 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,5955863183180796351,5038804107435237898,2097152 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4324 /prefetch:22⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,10052300136070680768,6932380215466313808,2097152 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16960489233993943508,4329525344816829122,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6008,i,1162216937996181553,83950182109102670,2097152 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5924,i,7330802489464742476,1129976383601123487,2097152 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,11839376006155516684,9700621071413731156,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4860 /prefetch:82⤵
- Modifies registry class
PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,17251603932729427048,15900312391807641154,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5816 /prefetch:82⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,6295579117143897674,11343112466112178664,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6220 /prefetch:82⤵PID:5388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,8589183066097837379,2642341459184254724,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6280 /prefetch:82⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,2618661516472083179,5285172493458729738,524288 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:5404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6380,i,9756956208234618630,5663567878975990607,262144 --field-trial-handle=1952,i,18433920452701053877,13268359374243161198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5992
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0cc0a965-02a0-4203-8cff-742d5471144a.tmp
- Size 268KB
- SHA256 95c17564efddded48f95bf00aefc8fc549180a9ecdbf0e32f862e705996cf6a4
- MD5 77e77eba93e98baf5a33fa06516bfd02
- SHA1 35b292e71e6b7b84e295c7928a8e5d7c2ad8a5d7
- SHA512 89ec44a359a977331df782b9da6ef1dde1b25109725bfcebdf5a52ca1e564b760e17fac970823928bf3ffdf5c217446179176478551996182cd005a525f96654
- SSDEEP 6144:RVQGSGkEZ2rJDyOqrKjb6+hFD+7t56OD9ZfSAppr7:QxxJr9b6yFSXD9ZfS4d
- TLSH T1804422236D868DB78DFE5205D1FBA705C9B578F7899A694540528F8B628FC4E0333E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\18100db9-a958-4234-a5df-5e434246c8e7.tmp
- Size 268KB
- SHA256 ccd0cb15c575f3e52fb51ae1e455ebcdd48d1a77219d0b73ca3b96ca48460897
- MD5 9db18808c0d9a38fc27b77fa592b2896
- SHA1 a0b9ca8f4fc34e52ab2cecb2eb0fb5b12320311a
- SHA512 c91bdad45edc00825c04b3b6a00ce33f46bf92d16f0cbd3f257eb36e7e91bc65d156ae2879cb3c4cac57f8fcfeb10105afe7c25a42512f754c4690d47beecb69
- SSDEEP 6144:KVQGSGkEZ2rJDyOqrKjb6+hFD+7t56OD9ZfSAppr7:pxxJr9b6yFSXD9ZfS4d
- TLSH T14B4412336D868DB78DFB5205D1FBA705CDB579E78999A90540128F8B628FC4E0733A32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\427f65d0-8c63-43aa-b10e-5a07919450e2.tmp
- Size 268KB
- SHA256 14853b298679a977a5225e1ccb6348711e51ebb2041e6574c73223a24281ea8f
- MD5 3b2c21d871640a7c1e7800bc1ae1ed15
- SHA1 d995471299acf54e7acde742cf2abca0fee8310c
- SHA512 51f02df996e598890c6801d65078625f9ce8fb1bf43e9477715d87ae340c5ac7dab1b21b0aef8caa9755e711ecd0479ac949f86b85e76324b70019d73f4b81a7
- SSDEEP 6144:oVQGSGkEZ2rJDyOqrKjb6+hFD+7t56OD9ZfSAppr7:/xxJr9b6yFSXD9ZfS4d
- TLSH T1AD4422236D868DB78DFE5205C1FBA705C9B578F78999694540528F8B628FC4E0333E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22187cbd-aaaf-4d9c-a813-441da35c2de9.tmp
- Size 13KB
- SHA256 23becfe45f75b0d4b0db8bd42a2b3a58154b6bad3e545845eac569ffd9a52221
- MD5 1f075616c6f6a53ee5fc39018fbce8dd
- SHA1 d178a9dac625bad21b763e8e5da88348a1365c33
- SHA512 955baac0ea4fd0747d55c524a59b59831d4a7deef4dad17c0af7c89eadddfc44d18fa7381afc65c11950d423986c97fb6bd4fb7d0425a7b9fce47579b8688d9e
- SSDEEP 192:TRLKL7FyjG7Uv7ApdPRp5na9WHsb+WNBFW6PZGeNDXAkwz/lOvkwSUVyIsnAUgrK:TRLKnXskDXgUwHMeuX/kvje
- TLSH T10352B529FE507A7B4CDBD32AF9567B13E7F5102228942E84A6FC893C15E7ACC2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d33365c-8266-4aee-9bf3-855df33c4891.tmp
- Size 414B
- SHA256 7bb837203d226616bc10baffcc0c91a0cbbfe281f78cd7f5c545ca8522932311
- MD5 2cba18f8977b19bee683976145821e04
- SHA1 a268c13e7786bda03abc3549bacf78875cefb9b0
- SHA512 5b0c986d21f96b6aed90292bb405d8b40a14c163da9e05a3a0d98fb1710e753e1c34dd47da6bc552adc61faeecf981511c82be21e88cb31282cb435d20870a45
- TLSH T143E02B65C961FD2709FD572914844646EB5413573FD0D40F373CC1088FB577A0A86C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\751921e3-4e98-421f-92af-f4f8369563a9.tmp
- Size 12KB
- SHA256 baf0e5d512772a2fda2ee9fc47c37a98acb56141bfb1b8e23dffd82deddc5def
- MD5 7f6f42b4681fa898254859f545b4348d
- SHA1 05e2bae9005741552fe0ef246da1fa8378497f95
- SHA512 e8dda6dc5fd456c3c66cc67e99b3089ea4267eb35615888ecea694e24e2d23943b3f1c0defe81299f29ee24ee0d569d0fc36e59ee353ef6d5cf8ce76da0d06f4
- SSDEEP 192:TRLKL7FyjGiv7TpAPRp2V9WHsb+WNnW60Wwz/lOvkwSwVyIsnAUgtaJ:TRLKnXuvUX6Uwj09/kv18
- TLSH T1D742B52DEE54B53B4CDBD32AE9567B13E7F9102128952E84E6FC893C15E79CC222740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7da96008-5b12-46b6-a900-745ea30328fe.tmp
- Size 12KB
- SHA256 81f31f65c449e74f00cdc8dc5ece4a75002c62e153b1b728d6bffd3b49667508
- MD5 be75cccdca0c61ab4d2ac29418ca5ac1
- SHA1 a4010e470c9e6e5ff64d53e20ac756b5ccb1626b
- SHA512 61d3120d5c9d903586cd3ed2ab7ee87987e4aca2f1cbd95daebcfa20ab4cf03b6a0859e044cacc0e1c5afb992083acd13e7c7ec8ca16cb33d662ca649d1413c1
- SSDEEP 192:TRLKL7FyjGiv7ApAPRp2na9WHsb+WNnW6P/j2Bwz/lOvkwSwVyIsnAUgtaJ:TRLKnXukUXjUwjD2M/kv18
- TLSH T19142A429FE54B67B4CDBD31AF9567B13E7F9002528942E84E6F8893C15E79CC222740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\85c7dcdd-f6b9-4369-b5ca-f890e369cace.tmp
- Size 17KB
- SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
- MD5 472d61bcf21443a047dac261aad552e8
- SHA1 608e068876727f4f676b88d75ee81c5361cbab00
- SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
- SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
- TLSH T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
- Size 33KB
- SHA256 f4bfdc9068a0a421a589ab97eb8753c2f88c0695fcb4186b034ca7a89c670197
- MD5 1d02d228755f1a720df240583509fdc1
- SHA1 cf06ff4a922cb28ee0549ede57eed3d0c9465612
- SHA512 b28f49a78d80a8537bf2d79db63e3de327ffb3bb65c1a4dfd18fcd457ebc11dac011576e335bb8a7699274455ef198bb81fcf67115f77a7f24e7b712aefa1dfd
- SSDEEP 768:5yATT1xnu8NRxzm+zKdK0OXjPUgC6WD6tQnF1z:QqZxu8NHihsXjP7lWu+1z
- TLSH T118F2F1465CEA6EDDD439F0A94B53641797201B968280FDFD201C38832289FE32335BEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
- Size 42KB
- SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
- MD5 665db5e157d2138835c4037c971ff3a4
- SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
- SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
- SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
- TLSH T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
- Size 115KB
- SHA256 66b06f6be346fbcab5e16bc8802cae9dba47d8cc5971ec2c5c4bc0a685ec1d11
- MD5 747bcaa6c33550aa8320b1151bb15cc8
- SHA1 8bbf08251034521660e62315776e2813e798d2f9
- SHA512 63deaf33117cfc3b48722e47d4cc6f6caca6d7075735bb60c3f7fb96a449507d20f8049b4e37eb2b75d07ed51e590e24d545d3012c68c4bbf54e67e7a00d3484
- SSDEEP 3072:OVcjMmMbTNZHdKYvlCVS2t3DA/yJp7YWrc:acgmKN5VM3kAaWQ
- TLSH T132C312523866A23CD4A91DF9FC83F69BA558E1C6751E1F0A02E83420BDF6904BFD34B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
- Size 83KB
- SHA256 fccf88c653d1a5d0624048ad617df53e05c0846e6c55b3a1769520aa6d15e2b4
- MD5 85d7a3db544bb5d57b86620b29b97c49
- SHA1 040368d4b72af428853eca0e5b4762c4c95a5828
- SHA512 d049f6e5d9466e168136bbb757647a2929a5cf3c119a2ee75a57d41f761206e28fa95353a862a1e1c26d2176da91fdb7db09177ed3f3cdaba31806fd29f5a94b
- SSDEEP 1536:9NUu3u1Idf2FNOGpy0Cdi4PlMMutzHeN5L8CoqFUgQFDcoZ/f3GsyCQUJKIZkQW:XzF2FzybA4PlZvQqUSoZnzy9UJKIa
- TLSH T1F8831252BF8196BFFC84E4BFDCD3272E85B5A47C2D19B35EC4A5C609282420A35D82DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 168B
- SHA256 cc889b322d172e7cadefd6ff3c5877a095b7b8c5473d2e1d82a1b08e72572a99
- MD5 848abb685fb13bbe29b01e7582e45f0b
- SHA1 62284154b82f43c53210d22166ae0215c2b8fd45
- SHA512 c2ba07bde13302333789989466e721abd254f4957907493cce6728778895036fb27b9434e26bcc7d9c30e3385e8245a6fdb92bc549174c48467ebebdf013f750
- TLSH T1C5C02B404CB09000DB18167491B208CE76FE351B01200103E1C030BFC81B2DB32D0070
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_gta.deloskiyt.pl_0.indexeddb.leveldb\000003.log
- Size 92KB
- SHA256 71ff7cdf7ed177f1890206bb4bf1fddeaa996527446afe2f6d1a89b8856c676f
- MD5 56b9c3401da2d062159ed0800bb613c0
- SHA1 17d4b356980ef1a3d4e18f748e0b813ca8ceb5de
- SHA512 56003d2575fb47b33581d74772878da5f68e3ddef591f6f73113ede4aa742154b0172114ee4a86da0da1999e69355656580ea1686e364f83a41b0089d8800077
- SSDEEP 1536:NqSgbkmYKIBk+NHhIlKhdItBd2R2DDb2wAOyCvKKG/4M3iESGgkY7Soqyzu8Nu/8:NqdbkmBukoBI4nITcUDb2bOxSKw4M3PC
- TLSH T159939F7BAF96CE23E0258A3245E90FCECB27AE517D50541BE4C1779C9E73A845C90B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_gta.deloskiyt.pl_0.indexeddb.leveldb\LOG
- Size 351B
- SHA256 c9e61c6f1b8fc811d50fb14f0fe306b104a8b8c1a61a9c133991f7df6860f812
- MD5 4780345706f1e1ce29ae3e94d31cd178
- SHA1 e198a61a5c1a1553aad441cc542d133f1afd2f9f
- SHA512 d0829172606e0992df96236f4a4f46cd2db6a8240f5e0d32510ec0495810d671bfd4fc800013d3155d1e7fc9a34f143edba2b9668a194b7836319bc1a014687b
- TLSH T1C8E0DF14A6CDCA6FA27C81B26935B70EDFE74909DB89284A4F43D80470C9C08A8A9261
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_gta.deloskiyt.pl_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3d486608-8515-4fb5-841c-aaf806531716.tmp
- Size 2KB
- SHA256 a5dcc3fecbe65bdc23eb725d8675b2e7e6fad144166e1d39f7468c718f6c3583
- MD5 55e3c374f37c7945df56a793aa987a21
- SHA1 fa35f9705f76ed9d7406605cfc3f4c1c98d88a6d
- SHA512 986f1b24b04b28c79add9fe81e7ed33dd5e150d21d51ffeb5d001f68db9c5be1d9878be984f8b2e821e89e233a24ecd86b4a07f909661b0d8c1a21a23c511dd4
- TLSH T1A341ACB7C3E88A3DC90166F4AB256F1FCE690A14532C3C56C9D4AE1F53E28F5E24058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a9caaf2d-d1e0-4765-9045-01177125d460.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d7cdcd28-fc7a-40f9-96ec-4d5162d977b1.tmp
- Size 5KB
- SHA256 f17c32edd164e3f11f70013dffd3de10b3b19399ca06162791ec7533a3870f89
- MD5 15eaffca056c9d8f24e179d3b9ed4391
- SHA1 5aa0e84993839cb118fcbe1f62f3a55445b7f3ee
- SHA512 b67fc7a779e868aaf2d5b302684efa7706a41a58e66fc299847d647913424fe79401242f5596168a70fbf62476bdfffae9f24d73260671c087f410274fe8f51b
- SSDEEP 96:DnmdCDB+4s0ppaIV9C1Vc7MArjQV4v+tXhKO/xKBShti:Dnmde+4s0ppaIV9C1S7M2jK4v+tXhKOw
- TLSH T1DFC159B787E8866DCD2156F0AB156F2FCF2D0924031D3C3AC9D69E5B93E1471E24168E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 9d2cd965fe0ad921df46bd0c4f50f578dba3952d1f63585f1ee14ee54ccaf683
- MD5 99e516d586f518e765f405c0a2de6ea0
- SHA1 7e559f8703fb624e8ab2d98ce338770930a31cd4
- SHA512 9e38142beefe64497b4ec1b92512bd9d1acb2e9fd22574c7d6e085a9f4bf4d9226e66d7bd33c48506854ee83cc312a3a81351d9c0fce17afc7b8f756eae8225a
- TLSH T1E0B01245C0425342C49203F5119014883168DF12F64D270142F40D62A839250C01B064
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 168B
- SHA256 f8f932ebf9bf98f8512356a1dc1bc2376a1bcb3f5ad0ed7acea404df27c3301f
- MD5 4dcaffa66ac7b39eeface139a9dcb812
- SHA1 128da48cbee70898f24be0fd04dcba8e8afb0987
- SHA512 6fe43358df129d3efcdb743254fc6dbf6755163ed7e6743e290b478b936458d6d34ad6de3e580021a7687c172fdcb34f18e0c60ff1e1467b7cbe237c899b2167
- TLSH T14AC09B55C506D121C41903B87979DD6C71947FECDA45134541FC1A4AAC76531885B16B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 49a439d121ea4aa3b7cb41f267c801ce69781c82ffb89ee061d07ea223c24602
- MD5 a77a41a092414453ebad4d6d45469b03
- SHA1 09138b8f8c6df45cd4f62c46d68b11999867cfba
- SHA512 25a8fd8cd1d1845d29bb8e5065e32a2b124afaa55f94cff2bc18af24361b5473655f25af811c2ef1a73add3b878fb21909acf67aeb99a198811f643a4b998883
- TLSH T157B00255C1026622C04203B0B99595D87575DF25DA1B1626E3F01EE6DD39A604D25571
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c4346d72-dd7e-4f7c-989b-d3fdb33a003e.tmp
- Size 13KB
- SHA256 ead4109a7d845e53a2bdec50bdc1b34caff4bfe6a3bcdc49be741c86625f7866
- MD5 afd38393d1973a7e82522d09e4648405
- SHA1 19785e73779af73b60320e046fa2e364cd4a1233
- SHA512 41fe59aaa59117c8d24fee0ec263a1553b1967575e072cb027fe0b5bf23ea895c6287ba5b34de7042ff648fc4fed01b5d8edc1d421d8452e76f6f437b158effe
- SSDEEP 192:TRLKL7FyjGmv7ApAPRp2na9WHsb+WNnW6P/j2Ywz/lOvkwSAVyIsnAUgraJ:TRLKnXSkUXjUwjD2b/kvhe
- TLSH T1E952B429FE507A7B5CDBD31AF9567B13E7F9102128942E84E6F8893C15E7ACC221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d8460468-db4f-456a-b64f-e8a1f615a36d.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dd92ef43-99a8-4d67-b738-b69e05ccea7a.tmp
- Size 13KB
- SHA256 fe4b542e138c54e2e2bef5842381ccee95d82449a05ac4602b1ba49802d8ca57
- MD5 e95db7030e11f4963bb4d2ff1969005c
- SHA1 ddb9fa6156d3ff081987bb1af0d0282dc5522940
- SHA512 82025b0c7fbceea30fddd8bfe15cd97a2a77bf16924615bd53dfcc1f4f216620c0d2962ca3feffbb8eefd5190a4d3f9c0408b18764bba15a70997472705714bd
- SSDEEP 192:TRLKL7FyjGflv7ApAPRp2na9WHsb+WNBFW6P/j2NDXSwz/lOvkwSAVyIsnAUgraJ:TRLKnXtkUXjUwHD23/kvhe
- TLSH T13B52A529FE507A7B5CDBD31AF9567B13E7F9002228942E84E6F8893C15E7ACC2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f1b21a3e-c3fb-408f-9fb0-a5957cfd870f.tmp
- Size 269KB
- SHA256 f7ad38f6358462d78c99961ba499bc7b32395358b0205a5f558aaa5d9e7e5f02
- MD5 354881ebb88bb58557b7f4fd90dbe226
- SHA1 e2193ff0582b005616a8f37351ba3bbecba3a5f9
- SHA512 2d4bce9f5a101c78357a81389ba53c4a7541570f1fe57869813e60ea0b6e44458e4079c97b54f6dff4c4e719cec93d195432495db5ba84bc515591f78f7d2fa4
- SSDEEP 6144:7VQGSGkEZ2rJDyOqrKjb6+hFD+7t56OD9ZfSAppr7:ixxJr9b6yFSXD9ZfS4d
- TLSH T1344412337D868DB78DFA5205D1BBA704CDB579E78999A90540528F8B628FC4E0733E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fc0570b8-8158-4d42-9b96-acc86a19fd2b.tmp
- Size 130KB
- SHA256 0b505fb1a5f0d992895315ba023b877c034419a9b3b35f8609116143448befcf
- MD5 7f26ce012328a4fa15994bf969f6661f
- SHA1 c08a01c75294a545bbdc63d3503ebd307ea94521
- SHA512 7c62b33ff7985be80b8d3293c4fb7f86d4e9d667a1afe031a90fda15bf8b9913328ffde2665bbb8666ef1e6f989d11fdacb45faccab76547eddd58c3f0274971
- SSDEEP 3072:B+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:B+hFD+7t56OD9ZfSApprU
- TLSH T175D31232AA91D87BC9FD6541B197A300DD666CED45DE2A09444A5F8EE09FC4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\favicon[1].ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~DF984A4A1773333659.TMP
- Size 16KB
- SHA256 8ca76f0b4e21605e83a1ce8ff18c0ae4eb70fe388e0e94a1afcb2f35d4b91f1c
- MD5 b4330196400d08388e82cccfe435e9f5
- SHA1 f599f2df2c82003d234a279e28866f11b38bbc0a
- SHA512 77868244c18141d6210af25ec41c36900a8e470240c21f713915367485a73a1a50409b4f71bbe03aabe64daa8acb8f7f9426b2061ffc58617f5efd5e0918b7c4
- SSDEEP 3:XhStPMnloVxStPMlglclllv/nt+lybltll1lRslkhlEkll9dgUrStPMtlllSFzm6:Xho6IxoGgUFAlkxPRro87goUt
- TLSH T1BD724C92E604CE89D73AB332A571316CAE32ED9B3DC18B01192B081418E668BF640C12
- MD5 SHA1 SHA512 SSDEEP TLSH