b19990f9cba214c2c34ac8a123a42626b6477dd90dab32999949ea7af61a82eb

Analysis

user interaction
yes
max time kernel
989s
max time network
974s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDTOKEN-main/IDTOKEN.exe
Size 6.7MB
Sample261023-tncgcadb89
SHA256 b19990f9cba214c2c34ac8a123a42626b6477dd90dab32999949ea7af61a82eb
MD5 b89f18d9400abc9737ed94a3845604fe
SHA1 af98b5f756a394ee460427b40837a395d5b8420e
SHA512 b8115cc024469b2716b093268d90ed6a3256c7d9be34c88e0a07a8db0188eac25fe1d1ae5e791c4e3008157e922ca9b3d6e2bba24079415ca5456cdb62b75f8c
SSDEEP 196608:m/yoqdQmR5dA6lsuErSEEJwdF6OLhYPXk0:Z9dQ2ls+9JOLh8
TLSH
T1196633A662613CEAE81F417AC082C620E7627D261391F27F17E58FA71F5B6B01D3F611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4592	IDTOKEN.exe
4592	IDTOKEN.exe
4592	IDTOKEN.exe
4592	IDTOKEN.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1800	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
1720	chrome.exe
1720	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe
Token: SeShutdownPrivilege	5352	chrome.exe
Token: SeCreatePagefilePrivilege	5352	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe
5352	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4592	4508	IDTOKEN.exe	85
PID 5352 wrote to memory of 936	5352	chrome.exe	99
PID 5352 wrote to memory of 1800	5352	chrome.exe	101
PID 5352 wrote to memory of 3764	5352	chrome.exe	102
PID 5352 wrote to memory of 3764	5352	chrome.exe	102
PID 5352 wrote to memory of 2184	5352	chrome.exe	103
PID 5352 wrote to memory of 2184	5352	chrome.exe	103
PID 5352 wrote to memory of 3284	5352	chrome.exe	104
PID 5352 wrote to memory of 3284	5352	chrome.exe	104
PID 5352 wrote to memory of 3032	5352	chrome.exe	105
PID 5352 wrote to memory of 3032	5352	chrome.exe	105
PID 5352 wrote to memory of 5280	5352	chrome.exe	106
PID 5352 wrote to memory of 5280	5352	chrome.exe	106
PID 5352 wrote to memory of 5248	5352	chrome.exe	107
PID 5352 wrote to memory of 5248	5352	chrome.exe	107
PID 5352 wrote to memory of 6000	5352	chrome.exe	110
PID 5352 wrote to memory of 5836	5352	chrome.exe	115
PID 5352 wrote to memory of 4084	5352	chrome.exe	116
PID 5352 wrote to memory of 2408	5352	chrome.exe	117
PID 5352 wrote to memory of 1720	5352	chrome.exe	118
PID 5352 wrote to memory of 4204	5352	chrome.exe	119
PID 5352 wrote to memory of 4204	5352	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\IDTOKEN-main\IDTOKEN.exe
"C:\Users\Admin\AppData\Local\Temp\IDTOKEN-main\IDTOKEN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\IDTOKEN-main\IDTOKEN.exe
  "C:\Users\Admin\AppData\Local\Temp\IDTOKEN-main\IDTOKEN.exe"
  2⤵
  - Loads dropped DLL
  PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdfc73c728,0x7ffdfc73c734,0x7ffdfc73c740
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,16691233870550052198,8040769115151723206,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,13510946813431268360,11861571892065356890,262144 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,4323723904159887631,16048461161282973695,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,7341155077037403653,15104113767793403370,2097152 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,630974972658536865,10844872489348834976,2097152 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,173686358344798672,7074396899691611275,2097152 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4652,i,7506699970335634526,10409716081357190675,2097152 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,14571604256710186054,10871688276067601318,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,6434883888595139573,5063978140739111479,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,9967594422068871053,8123149731774441477,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,12750040091778366672,10332134009399253918,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1204,i,15074124016031770889,6444264777265380971,262144 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,2594751755044130230,8043926592360890760,524288 --field-trial-handle=2052,i,7165205921101638508,1066106204832615464,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50fc5971-8668-4e30-97c0-4d978a6ebbac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\50fc5971-8668-4e30-97c0-4d978a6ebbac.tmp
Size 270KB
SHA256 9bd1d608281d8b9ed3f8fe723fd0416e3f4680a00b408259018284b1ebd8c763
MD5 c5100041301b67b0c1a42a8ec8d7f5d5
SHA1 edacd6c65f0a36e24611e7a71782c4cd920144f8
SHA512 07d7540fe23512e9266b8e66fc174e7eab66dac58443e7bfc112b1c7271ed82d49b73d704d263bd9a2144aedf50795a504c3e66cc7762dc33af2ce661265a258
SSDEEP 6144:qkCZSirXGcFskOVjHn23+hFD+7t56OD9ZfSApprv:wxLrsh23yFSXD9ZfS41
TLSH
T1974422327D44B86B1D7C18D2F09BF504DEB1EDDACACA590AD4455E8AA01BB4E0F73E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f1cce1b-f66b-49f7-91f7-1c2337f9e01d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7f1cce1b-f66b-49f7-91f7-1c2337f9e01d.tmp
Size 130KB
SHA256 bb61ea86a7d2c3cbd85e098111ded79884f619c9a5cdf79f8458440c5b20e8e8
MD5 a734dc693dcd01fd8fa050fedef2cc59
SHA1 e9acaa3b9e209e9715380e7511de4c7d5249ae8d
SHA512 6066d43ed338fae698252edfceaa1aaa40aa74aed1a541726b0ed3cc91d0f3ae6448824482f446698fa8fb21224b73b058173fd17854474916b1bce92ec915de
SSDEEP 3072:U5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:U5+hFD+7t56OD9ZfSApprB
TLSH
T1EBD31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ef79811-efdb-4141-aa46-31729255792d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9ef79811-efdb-4141-aa46-31729255792d.tmp
Size 270KB
SHA256 32e13068c1d4ab7892727454faeadffde52470bac33e9339ccea9875bfc44f9e
MD5 cc3e487b541ab0ed931e8d3300767785
SHA1 82751cd7dbdbcc895203497e18d3bfe1ddfecfac
SHA512 6fe87439666a20ded6fb84e1bdacbc6ff96da0cf84de5f71a78f3eed544a0db2e7cf4954ab186c27c9599eacc4051cecc8fef4b458d9898da715f1fd2df82865
SSDEEP 6144:qkCZSirXGcFskOVjHn23+hFD+7t56OD9ZfSApprv:wxLrsh23yFSXD9ZfS41
TLSH
T1FD4422327D44B86B6D7C18D2F097E104DEB1EDDACACA190AD4455E8AA01BB4E0F73E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08251fea-256d-4692-9432-e73206e86f8d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\08251fea-256d-4692-9432-e73206e86f8d.tmp
Size 12KB
SHA256 350d03b4b906a16f3f22f53260e59d21b4e1e19b085117030984a18c9f2d00fc
MD5 86d3a066433adb604ec58a630d87e513
SHA1 af3692f667b86030c315ee2b8d8edcc78e522b2c
SHA512 1cd44ad295d09a56cc13623725d4e806bab8b19435440013676addedff235e06b44f740ef0ae5e9db9024c242a65a6388e6f8a01b5084b93594505d25b7ee527
SSDEEP 192:6RSt5zcR3aTGv7GpAPRp2C96Hsb+WNnx/0SPSLkw7aWUOVyIsnAUgtaJ:6RSt5zmuyCUXtswF0jLbaa8
TLSH
T18F42602EBE10793B5CDBD22AEA223757D7F5102625D42E84EAFC893C14DB5CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d7893d6-bca1-4d67-9a71-ff829ba491c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d7893d6-bca1-4d67-9a71-ff829ba491c9.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f8e7910-584c-4ab4-9e7a-352b0396b473.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3f8e7910-584c-4ab4-9e7a-352b0396b473.tmp
Size 13KB
SHA256 91116b23735dd5e01d10e2dd7b1b31adae41da44137deab494c87c78711fa456
MD5 def1ee56011e5ba49959a53d06b812ff
SHA1 781bbb8e83f342a414d18f79e9174d02b671bfbd
SHA512 71176bd3881fbe4fe6f07b22890c89cf4df6e7d155b2e62e0d73d918e52806fbde04187f98cf611832183d1c7439f98314e87e7ae409420e66a0cc21e2a1bea8
SSDEEP 192:6RSt5z3R3aTGv7GpQPRpaC96Hsb+WNnx/0GFPSLkw7aWUnVyIsnAUgraJ:6RSt5zBuyCUXRswF0GoLbaVe
TLSH
T12652812EBD10793B9CDBD32AEA123B57D7F5102621942E84E6FC893C14DB9CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

490d2c24-b53d-4d7f-bf4e-52f94976432e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\490d2c24-b53d-4d7f-bf4e-52f94976432e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6dcd2cbc-c658-4be6-994d-762d01a0ac05.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6dcd2cbc-c658-4be6-994d-762d01a0ac05.tmp
Size 12KB
SHA256 5bc50030f83d9633b2b9996b36c2d55b34a5b5aa5f1828b4457692e2c18b3ce9
MD5 6c266abf4e0675b27b5c4323e19bf51f
SHA1 2e7e831c7c04cf319c2f2313a518c6beb505b086
SHA512 0a0dfe9bce656aca25df9798eea3cd059dc9755fe1558c3b548f4f40031c5be39ff2db64b26006d877394b2561c4d8d74f920442fad2899a730a99cc2490df1d
SSDEEP 192:6RSt5zcR3axGv7GpAPRp2C96Hsb+WNnx/0SPSLkw7aWUOVyIsnAUgtaJ:6RSt5zmiyCUXtswF0jLbaa8
TLSH
T16C42712EBE10793B5CDBD32AEA217757D7F5102621942E84EAFC893C14DB9DC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05e2737a-869d-41ac-a18d-f37726d87479.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\05e2737a-869d-41ac-a18d-f37726d87479.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8581da18-e7fc-4cef-9f56-6edb34db5e85.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8581da18-e7fc-4cef-9f56-6edb34db5e85.tmp
Size 523B
SHA256 91b9946d1f8daf13ab9c49c08843744903c93fffd209f515c18f80991b886c07
MD5 ab4f6b7ff100a59297de492aa4c7d868
SHA1 f091ac782a430d09a0948fb1d805c414a74dd820
SHA512 4aefd28ff5af24c9072c6ee543222d25009d6d10cdef34671abbec64c7d8a6e30874baffa0ae2a2695009dde757e7dbcfc9de4c500e4bf00efc872a6fdcefc4b
TLSH
T153F0C9A3F6BA743B917A54B71D00780934B5A83001C228F8CFAB822DF0D68E71B22003
MD5 SHA1 SHA512 TLSH

Submit Download

87dba792-43c5-400a-837a-f02a0485326b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\87dba792-43c5-400a-837a-f02a0485326b.tmp
Size 2KB
SHA256 dc17380b188939c51ce872b277517332f5fb5c86e2bb28a0ac29cf06921776ca
MD5 b3163bb17767d527fa2611c334607062
SHA1 e8fd2b38c11e5089ed468d52352e638d01321a8a
SHA512 fa24a6d21a00e485e822b1f4a0c533fb84424ace9f433cf009492ade6f94ca72b02bf53fbc19fae1ec8dcf008de97c636a1951cc20d61003d88b0b8c7e0d3594
TLSH
T1AA51ACF7D3E4CA7E850166F49B217E1FDE6D0A14122C3C66C8D4AE5B53E28B2D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

a69c1abf-8061-4f1d-9c61-f8c7dc6d86aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a69c1abf-8061-4f1d-9c61-f8c7dc6d86aa.tmp
Size 2KB
SHA256 ebc4d1a81ad34069b1e3b249db5595dadf9b2f018c7ecbb5fc7c7972f9931448
MD5 6948814c3391f7e1ad058761bcf82e54
SHA1 49ef493cac83ee6ee3a10c85e9107bb65689e5ba
SHA512 7d14b414e1c2bb7c49cfec88d273b2e65ff2417d4199022d6f2169ff79b402ba685292d1e580dd0f042cf164b8f0b8fb9a0be7e856eb5b3065728191c0e8ce51
TLSH
T12B519CF793A4C67E851096F4EA11AE1FDE7D0924132C3C62C9D4AE1B53E2872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

ffd0b453-9f8e-412c-9630-dfe5794d7013.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ffd0b453-9f8e-412c-9630-dfe5794d7013.tmp
Size 2KB
SHA256 83f718975da1c3b02537aa3950c52f995a0e85761af69413479091753ed5a025
MD5 3ba4c1492329b479dbbcedf9af6e8d9a
SHA1 5f97ee07165e8d8f26f4ec644b23e63ba3925bfd
SHA512 f6b0a35f70ec54343d1be246f29d5795c14acccb5c689f463131a06c01d9b7ca547424bf15d75851b6353b0c95cd3b8ce74ed461c909cd92e0a7ffb5630ade39
TLSH
T183519CF793E4867D851096F4EB156E2FDD3D0914132C3D62C9D4AE1B53E2872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 75a38c6821e7074459f7a9a7f5f99765e7d916fe2f082d5bda5022b24ca0c564
MD5 ce1d21f59d3f8eff489cbf1ef30021f9
SHA1 1e5b920c1f3a574838205e5706e6db7341c62da0
SHA512 56c2b415966215d318a25c17d5457ed1c15e0e503c2195d4cf42c8a488a73fab7c7cf48877aaf0c91966b74f6c3413a87d1690bc50bf7b922abd5144e48ae38b
TLSH
T108B0120580436701C15103701260A0587260CF36D512138961F00D36D837160415B148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 511825113588db603f96d6d2547b2de8094cebcffbf6a2baaa4fdf720cf81633
MD5 764938e27c5616a75c48267dbcfcf881
SHA1 37e6cdf4ade80897ef9d064934681959d2b3cfc0
SHA512 3ed79b302bb83b76e7824a16eb6166f8b8d72f3fcfe7a8bf362c5e498728543e4fdbd6021a17dd9e6a408d5e178a07fbf58fc246dfd72a3dcaa0f637b7ce80a0
TLSH
T127B00265C102721EC04243F066A5A5D8B2A1EF3EC6432313A2E01A76DC36672557EAB9
MD5 SHA1 SHA512 TLSH

Submit Download

cbccbb0c-8cfe-43a9-8015-279243a5d12d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cbccbb0c-8cfe-43a9-8015-279243a5d12d.tmp
Size 414B
SHA256 f0501a1a4f5b00536c596fdad3b9ad3fb03bbfc8ad9ce4ceae364fdc02f3a82c
MD5 60569b7d89363419b56b4bb208b33cf1
SHA1 67a8c2deffd455747714f0bfc152c21e76ccec14
SHA512 c00e6181efdf05f5d8dc8e440dbd30b4f35b18afb0c57a5d930df74bbddaed03822ed005bb1110491cb26f08d27e5d2f150c63a8d8bb6a23a08fcc15642f606b
TLSH
T182E02BB6C825BC3B19FD5B3D51108B87EA5913173680841F3B3D41098FB9A3A018985C
MD5 SHA1 SHA512 TLSH

Submit Download

a4691095-2003-4521-9343-4cb4cda6549b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a4691095-2003-4521-9343-4cb4cda6549b.tmp
Size 269KB
SHA256 c844ce6d6a3a5e24eee2efb9f0f29e63da801c7f33201aedf31f076d51eba5c6
MD5 db1483b6d3ecc5973e933e199768b4c3
SHA1 be559585aa1749b2b57e529b20e84107eae743f3
SHA512 7be387699d7a96f916c878b19c3dcfc2a11116c59de0f25676e9e6aba9cd4cb9a198f1aa019309b6096d7e79e9b03cb6bf6bb04430ece5ff858c0469a7287551
SSDEEP 6144:qiZSirXGcFskOVjHn23+hFD+7t56OD9ZfSApprv:bxLrsh23yFSXD9ZfS41
TLSH
T1EC4422327E44B92B5D6C28D2F097E104DEB1EDD9C6CA190BD4454E8BA06BB4E0F73E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aba4e422-ab0b-4bb8-906d-eaf0f320a24d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aba4e422-ab0b-4bb8-906d-eaf0f320a24d.tmp
Size 269KB
SHA256 1b3462cfb5c29f9de0fe452386b9ce393be7d7b9034ed7ff84dce940b75c1fd7
MD5 0161c8561945929e1bdd1b07ad921d55
SHA1 b91c80a51bba20e5976c66bf9f81d872ad7aa6dc
SHA512 c5e87d1361be0cbb9848fe2d9403f2733d118da649ed4022296017ebc7ced10b294f5fbacad8236e1bef9e085982f8b063e0769d1763b9beec494c38d34a8db1
SSDEEP 6144:DiZSirXGcFskOVjHn23+hFD+7t56OD9ZfSApprv:WxLrsh23yFSXD9ZfS41
TLSH
T1A74422327E44B92B5D6C28D2F097E104DEB1EDD9C6CA190BD4454E8BA06BB4E0F73E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45082\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45082\_ctypes.pyd
Size 120KB
SHA256 af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee
MD5 df6be515e183a0e4dbe9cdda17836664
SHA1 a5e8796189631c1aaca6b1c40bc5a23eb20b85db
SHA512 b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253
SSDEEP 3072:aBxSn2prY3+52vWqw9RQfLIgRr5kNIgQPUZxhT:acuY3+uWHQfLIIkFT
TLSH
T169C35B1B2354009AEAA7407CC5B35E47DBB1B459572087CF02A4CA9E2F637E36E7E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45082\base_library.zip
Size 1.7MB
SHA256 b8e074772e3f8203de0e4313ac274de4d4e5b5e847a3fe3dc4171413ea2a4502
MD5 c6b150f2eca4eec01765bdae9a78e097
SHA1 1eaf2a18863af05d4f8183978ea6ecadd21ed3de
SHA512 697cdcd1f23cf67683836cca593df643f3f2d3f139fdbf86bf990bd7c29a6721d8199fbff491cb234d2fb65bcd4f32f07796b8b522b895a52095d17628beb846
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfbGz0iwhaM+dYf9PIsfvTZLdma0uHHf:mQR5pQxmiT8NLga3
TLSH
T11C852B817992B5B7F804F3BA4026090DB328C5F4FB40C75739AFC1A6AF9E6A46D518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45082\libffi-8.dll
Size 37KB
SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
MD5 d86a9d75380fab7640bb950aeb05e50e
SHA1 1c61aaf9022cd1f09a959f7b2a65fb1372d187d7
SHA512 18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
SSDEEP 768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp
TLSH
T18C036C0B518418A4E657D53D87B65A26C334B9280B61F2CB03D4C27A2F6B7D6EB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45082\python311.dll
Size 5.5MB
SHA256 aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038
MD5 a72993488cecd88b3e19487d646f88f6
SHA1 5d359f4121e0be04a483f9ad1d8203ffc958f9a0
SHA512 c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38
SSDEEP 98304:qvpgHup+dhRXLPw3W47SrSUHfMWdPrjUOYmIF:qvpgHup+XJrYWYWdjUOYmU
TLSH
T1CE467C22726584A4C97B8076EA2F8647D7B27C505F20CB0B61A4B7992F33B531EEF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download