ba484ec4940386dc952c5f4a42f30f8d29404d240e1daf78521f6cac969b4358

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
899s
max time network
887s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Text Document (6).txt
Size 476B
Sample260421-ppk3naas2w
SHA256 ba484ec4940386dc952c5f4a42f30f8d29404d240e1daf78521f6cac969b4358
MD5 9c8e3eaf05a0ad18fa84cd3017b355d8
SHA1 7a612076d8354e5cc838280d5829eff9586dd200
SHA512 ddf8588bbefa1e33efe28944d7b95926aa23cce256f5722e303432e58640cf8b08d20d8424ad0d601a0cd2552f06eedff5826ac8f12e4420a6a10b09467e8d4b
TLSH
T11AF0EC1B331BD2A044A060E1093C31CBB622304B5E5DB9E0798B70288B390D232A88AE
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3008	chrome.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
4432	timeout.exe
2724	timeout.exe
1812	timeout.exe
556	timeout.exe
1996	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212483269449211"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Key created	\Registry\User\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\NotificationData	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2640	chrome.exe
2640	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1680	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe
Token: SeShutdownPrivilege	2268	chrome.exe
Token: SeCreatePagefilePrivilege	2268	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1680	652	cmd.exe	80
PID 804 wrote to memory of 4432	804	cmd.exe	85
PID 804 wrote to memory of 2724	804	cmd.exe	86
PID 804 wrote to memory of 1812	804	cmd.exe	87
PID 804 wrote to memory of 556	804	cmd.exe	88
PID 804 wrote to memory of 1996	804	cmd.exe	89
PID 2268 wrote to memory of 3940	2268	chrome.exe	91
PID 2268 wrote to memory of 4420	2268	chrome.exe	92
PID 2268 wrote to memory of 4420	2268	chrome.exe	92
PID 2268 wrote to memory of 3008	2268	chrome.exe	93
PID 2268 wrote to memory of 232	2268	chrome.exe	94
PID 2268 wrote to memory of 232	2268	chrome.exe	94
PID 2268 wrote to memory of 2096	2268	chrome.exe	95
PID 2268 wrote to memory of 2096	2268	chrome.exe	95
PID 2268 wrote to memory of 700	2268	chrome.exe	96
PID 2268 wrote to memory of 700	2268	chrome.exe	96
PID 2268 wrote to memory of 1264	2268	chrome.exe	97
PID 2268 wrote to memory of 1264	2268	chrome.exe	97
PID 2268 wrote to memory of 1128	2268	chrome.exe	100
PID 2268 wrote to memory of 1128	2268	chrome.exe	100
PID 2268 wrote to memory of 4876	2268	chrome.exe	101
PID 2268 wrote to memory of 4444	2268	chrome.exe	103
PID 2268 wrote to memory of 4444	2268	chrome.exe	103
PID 2268 wrote to memory of 2996	2268	chrome.exe	104
PID 2268 wrote to memory of 2996	2268	chrome.exe	104
PID 2268 wrote to memory of 2096	2268	chrome.exe	105
PID 2268 wrote to memory of 700	2268	chrome.exe	106
PID 2268 wrote to memory of 2720	2268	chrome.exe	107
PID 2268 wrote to memory of 2640	2268	chrome.exe	108
PID 2268 wrote to memory of 3352	2268	chrome.exe	109
PID 2268 wrote to memory of 3352	2268	chrome.exe	109

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\New Text Document (6).txt"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\New Text Document (6).txt
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\New Text Document (6).bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2724
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1812
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:556
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9525ec728,0x7ff9525ec734,0x7ff9525ec740
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,17231008077316856372,5588568784612961595,262144 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,12367931361749665607,5487207751062408321,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,1576137042130093352,12777598289273385674,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2564 /prefetch:13
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3587818933475467698,1294227988753490955,2097152 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,5291944054812337438,1778770397674897741,2097152 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,15195674230646104160,7992291759771509234,2097152 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4388 /prefetch:9
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,4831016330626788705,4769335130496968312,2097152 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,3243860964778448167,2053008020583506891,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5612,i,5402089312832258134,11520700667568907702,2097152 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5800,i,910175287770011592,4429983544291747317,2097152 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,8215103197444812488,1284398342812706824,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,9574217689304998783,6524425567870225287,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=224 /prefetch:14
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,11773415244150049319,7899797409740303121,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5404,i,4083119784853206999,3943099733096186776,262144 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4404 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,2871333317198177705,5895370979562768722,524288 --field-trial-handle=2000,i,6952830481636076464,4513861609977320564,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4640 /prefetch:14
  2⤵
  PID:3352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2dabb481428294da9787914de0a57c1284f8d575b9a88711230f076b7485dd2c
MD5 0aa42c77456d31f705da1509a7c8bc5b
SHA1 5a79a802d72cb1a934b92a21f50bf535b732c828
SHA512 03b28fee636591bfce6df7ecc9ab9af90e70612285a3b0ebb57ebfd74256bd1dfeb002c1765ba61443a2ef43b40b0d0418525bb522c67a9a75b574420e90550a
TLSH
T161E02BDDD921D82749FD076D60580B46F72513572B41484F3F7C920C8FB096B498596C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6fd7e0d7923f4062044b1a92bffb9a3eddb310d1cdd22ad91a66952ad1440d60
MD5 f7420aeb9462fb6bc2620c0ceb86da0a
SHA1 a1beec065fc4dbb6d1b0763250d19b7c5e0b2f48
SHA512 189a480601040488a7caeaf286e04c70836b0e6bb4842ec119e33fd7ea28210b5c1692ea82f1a1420738358964464b1ca8d6a5e757aa8c81ac3cff654865391e
TLSH
T19521CC0DA042D8C5EBBAD2B65EAC0D9FC5443D038DF29E7F91C844AC3E2A9B52095953
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ccda0656c8be3785f1ad04ec9c2e94e090cbbee0b31fa8a4e56d272feea1aff7
MD5 26adb2d967b205e292d0760ef32ab2c9
SHA1 a756d03ca94f5420c5d0a814ee92336549c158c8
SHA512 e5450b0e9f3ec75f44eaae02eba0158291ad7a96c1cd90a52062c9b1807457f695957dc700f35bf8ff35d19c9fb84135d276bd0d4db7c600b3e3dc6adf735e18
SSDEEP 192:DmaIwNZHkuZkh85wr/52IaacFEulybUSSZKImIzIF9TDrRmKD1RuZt44vXNlI:DmaIwNZHkuZkh85wr/52IaacFEulcUSf
TLSH
T1E7128EF7C3E4C56D891156F49B25AF2ECE290A24032C3C76C9D8AE5B93F2832D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e745f6a33b45eaa3676dc0e964922bbb26ddb4a673b29eacc4cc2025c049316d
MD5 abcdc0be3f4548cc024f8895e2c57b76
SHA1 916b94caac225eca5e1f965bf72c0c9a6225d917
SHA512 227247cf4e4fceaf859fc89240c32cbff8a76697e0b40ed5129341c406d28a722af9752b2c71e84d44bdb61b3507e964b3d420353b8a54ae9ce6221e3bc33686
SSDEEP 192:DOabfypJJEDxuvCYrjIaacFEulybGdSZ1I/IlIhIc9TDriXKD1QTsvZQOf44d:DOabfypJJEDxuvCYrjIaacFEulcGd41i
TLSH
T150326CF7C3D8C52D891156F49B25AF2ECE1A0A28432C3C66C9D8AF5B93F2831D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 619740b83a53ea4d1c3efb2b367ba1ae4cc05b1a91318a5233ca5e8fb6a21598
MD5 f690bfe8dcfa96916f8aa9b44f6d03d2
SHA1 b9b0f4c951d27e652b6b4d842da03d7c60eac7f1
SHA512 923b03c002391b85281c787d4defbadc74ad59941790b032bfe8e56603f2666d4cb7b0180ce420e03e7138acbdf327242d9f0dd2327611bca131d58f87cf9ce7
SSDEEP 192:DmhIwNZHkuZkh85wgE5eKIaacFE7lybUSSZKImIzIF9TDrRmKD1RuZNvXNlCjhBL:DmhIwNZHkuZkh85wgE5eKIaacFE7lcUI
TLSH
T1F1128CF783E5C52D991156F49B15AF2ECE290628032C3C76C9D8AE5BD3F2832D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 2b0d79abf273c64f377bb5ea6c6b739390ff2d9316fe3f27960b944e8a855cf0
MD5 c1df1abec9735e8e34675cab46d5a567
SHA1 f8799d812cfb300d17a007544e7428bf3ac6bb37
SHA512 120d43e256567a78e1c4ccdb94a4c4400ddefde3f2be623d9a5a6d6c34fbcf6b61eb32812bba6cbe4ccec7f25cd03119388f424411eb32c83489d35892393380
SSDEEP 192:DOabfypJJEDxuvCkIaacFEulybGdSZ1I/IlIhIc9TDriXKD1QTsC1D:DOabfypJJEDxuvCkIaacFEulcGd41I/G
TLSH
T1F8129DF7C3D8C52D891156F49B25AF2ECE1E0A28431C3C66C9D8AE9B93F2831D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b4c0945cc47b3699d239d28ed715c3a511d4799cba9dd1b561e39f795b8ef0c0
MD5 0f4900f45903d587b57fa2a7f8389699
SHA1 9ddd87076efab6aa3a249748f5cd5198a192ef5d
SHA512 eaeadaad20e3598a72cffc45e94122fb377a7b76e82ee428b1c25fa09955f9039be6e6f19a9cae1005e5ccfca211c9173c8d81fe01ab06725d4cc97fda4583fa
TLSH
T18051DDB3C3E8997D881156F4AA246F2BDD7A0A14531C3C56C8D8AE0F57F28B6E21124F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 683B
SHA256 4ef4d3cee603e710a6f622e1b7e3a596b22d500034f139a824e6ba1cfe05023f
MD5 41b4a970194c3536f7ba90d253a505ed
SHA1 e71f9e7e3d6bdd3243ba1e78ec685e644ab4dd1e
SHA512 719c253ae38f7f3fe477496e1b5ec58ff97bbf7f9fc8a0a7f0f688fba078990f485b95ce170a598c064413cd2b3ae48bae9fdc9c57551535ede815b0c1fb4a9e
TLSH
T1C7019EA79B7DB85B20BC48AF1D00B8092571BC3542D078E4CFA6412DB0996FB0F02043
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 284a814f36758d82b4cf392334631a6d52990f9d550c8662d00f9be3e3b247ba
MD5 9f59525bfbf250cac2c8d0a1706fe1ff
SHA1 dea36a857decf55175d78d89351254a72334773a
SHA512 b64644b553b9c48d71a67a2553779ee24ba0356bc81261d7c86621dde045c3cbc0cd21b4a9889d010a3332bdda420a036365926d346bba7146d181528e41ff98
SSDEEP 192:3RscBzfW8YV8v7ApAPRp21YW9qHsb+WNnE64Gk2p3XRT2WZUkwUaHuSVyIsnAUg8:3Rsmzf+osUXk4w5u2ZXRT2WW0aOS8
TLSH
T16E52D82EA914B93B5CCAC31AF951B757E3F6102161942EC8EBFC8A2C15E79CD6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 efc524b7aa427f6101b5bd4f45bd1c1ad1ee3a0bd7fc2f4b60c252c1430224ea
MD5 28245ebeea47ebe537f88c86a9a6859b
SHA1 b08ef3d5fbf13db03998eef69fa3f1b5eef251fd
SHA512 b1a9273329fe1dc479aa08408a467cf118a25daebeb2050db01ec35e149ce8d69ff6b5d28325db9d2d20cf2caf94946c3640b5e0dfe031f8b18f49676ae8b982
SSDEEP 192:3RscBhfj8YVnv7ApiPRpo1IN9qHsb+WNnE64Uyer3XRT2WZUkwUaHuZVyIsnAUge:3RsmhfTvsqX14w5mejXRT2WW0aO/e
TLSH
T16A52D72FA914B93B5CCAC319F952B757E3F9102161942E88EBFC8B2C15E79CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0aea5a409ab47237216c8dedf18f77bfe292061c4184424a273ee2aa25eab2b3
MD5 4835d8a4fc78d421c4b7f1bf74d71786
SHA1 3541afc2ea0875dc5523e13b95f1df5f75de5aa0
SHA512 91310bfc1c13a46d4cbc2bfbffdb46df40b959dad94a38055fea916c54aec2609ba0ee654b4feefc4e6c72b28fb4c9df6f53833b62cac84ea36c7c559550744f
SSDEEP 192:3RscBhfW8YVnv7ApiPRpo1IN9qHsb+WNnE64Uyer3XRT2WZUkwUaHuZVyIsnAUge:3Rsmhf+vsqX14w5mejXRT2WW0aO/e
TLSH
T17D52E72FA914A93B5CCAC319F952B757E3F9102161942E88EBFC8B2C15E79CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2182d69b4661a2c50039929522553aff13ca5a5029d1b09f9b36676f82cbc735
MD5 deda84fe9211b3405d132e39530a61d7
SHA1 ae62fec761e4dd7a8e946a4f8122183e641f2cea
SHA512 f8580cc26c8aa9b69715a77287a14e90642e0083cc5df33adffbeb9d9126ec4b37fa587c51cba63b459da8631cd2fcb6f1ff2439a47d5bac2f73b6ad61516417
SSDEEP 192:3RscBhfW8YV8v7ApAPRp21IU9qHsb+WNnE64Gk2b3XRT2WZUkwUaHuSVyIsnAUg8:3Rsmhf+osUXC4w5u2TXRT2WW0aOS8
TLSH
T11D52D82EA914B93B5CCAD31AF951B757E3F6102161942E88EBFC8B2C14E79CD6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d01871dac692e1e6c690a4639cdf4c185446f41b1a90594deabdf66c7fbb6a57
MD5 441a9d0e5efcae2bf849774300de4cc2
SHA1 5ba7985708812d1303f6f8ed5bf8c026764ad16d
SHA512 e7fcf13abce63ef28a8506e93af0665d97ced86b9dd5ed40bfc9d06d0f3c6bb4a3300dd5e71d892d4c6bbcd7764264156f189e82a5a78022f30a164b48baa4b6
TLSH
T109B0220CC003A222C0C203F028A2A8E8B030EF20C203A30283E03B32CC202A00822020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 42d28aab013c52e1513ce9e97a110f919a3b5adf399271e3766097f776222b6c
MD5 af67c627ba8866ca05318e32bc1d39fc
SHA1 066787d90ec272630444ed766db4a826a1eaca63
SHA512 6b1ed0a8a2e501195269b786ac46e4ab6dffec598984a9a80e9f1a51f94e5dc3c76962b81f044a751d4a13fb53bf70c8d92677372d4cf48a9dc18f8d1fd16fdb
TLSH
T109B012A08005D911C40302FD118308D87114AF14CB151B0293F07D7598261918054150
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 b1e70af7537d3b2f7ba43f617128689259ef264234bb66c45cf5577eaf794fba
MD5 ad469df9a4f0146264cf9b583f09ce6c
SHA1 d020d2e4cb3ef8e6666f7912395a65210d90335f
SHA512 3113e7500052e2fb2418955e2e06f4edb8eb5a601213c4af9cdb21c192ff11ec8088bdb2723bdd2903dda56139b0a8e742f2d7a7cee4527d41f4e28a730d70aa
TLSH
T1D3C08CDB0420828BCF70FED82038312CC10B434D8CC9CCFCA108120261B896B4042528
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe599c84.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe599c84.TMP
Size 157B
SHA256 e2932227fe4fd2c831437b39379dc3359460d1f03638f990b95805c405ceaa20
MD5 869318b6d420d55633e6dd9b2773b135
SHA1 5f11035cd766956ed85148cde453ade06dd86180
SHA512 9991e03f8ac8dd86c37112083ae2b51c5a69101e4c723de2569a25f3581b550cea6939524f04d7bcc1360becdf84cd8f37af6f195d937031d36cda9c971a3bae
TLSH
T111C08CDB0420068BCF70B9D52038316CC51B4E0E8CC9CCFCA108320271B896B4082528
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 0f4fd9eee58ac18dfa40e98f776f425bcea082c7ffbdbe09c43ebe891a4964e7
MD5 339e8c4541c8d8b4cce84cc1b1a58c1f
SHA1 ace2bc9a6071733884e7594b9d7bb76223672b10
SHA512 25b03755a094af482f0cf4a503b8d487048dd9a844de132de26a421f153966c3a5e6c42a80343bf9ab4ecf6c37db490db62e138a425c63843cdaae73e0f97245
SSDEEP 3072:iwtLn4S8GqEYfMFgU+0RSlbywsmJdAv91++J3qUQm08KMWF0bFTcVHr6zn:iuwGBH944z++JjcMW2VcVLM
TLSH
T1631413F6A80D7CBA175ADAD5801FFC6BCCC3948F5D05AE3C30867B1A044D2E3A796895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 d364129184760e2bcb59f780805362a86c4114bdca4c8f7410184effb3f05c57
MD5 e9930d5573de6f52a5c450e5a929e4c1
SHA1 4f21c50ee8731b3b5e70247351608b021bd7a8a0
SHA512 3a96b38e9f9a274b448ceb5742f48cbf42dbe827cc8fc923dc5f5a8b74701b92aaedf47b2739db9a195a02d9a0b583f3842a9c0981ae5fc47e22e1932e21dcf6
SSDEEP 6144:A5iXcI+YlKRWcwGBH944z++JjcMW2VcVLM:ZMRYlrGBH93VOMWe
TLSH
T1854422F5680D3DBD165AE7D5801FFC2B8DC2448FD816EA3C30D6BB14285E2A3E7460A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 43d56fbc9bf2a0eed146d17059def4c99c88bf8e273cd5f12f4edb9e0db0d86a
MD5 30a87e49e6105dc7cb252312f6408e75
SHA1 c9d0e9861bea4671f29147e5c8c3d722de0a713f
SHA512 6bd66c5fe3913be20888a35189c86832486e48c3825a18542b49b5b56bf8bf7b56ff74436f75f46d465937637646e3a7da4ff315fe01a296c2a4366fddd552b9
SSDEEP 1536:hZvP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:P++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1BC9302BA591E7D79636AC39690079CAC8CE3CCDE1514557C30C7AB1E18BA393A30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 7d1b3a1c5a948c1f5e4b903bcbf8ec87a9604664e82a7149e234b79228db7ae5
MD5 8ceae8989344ce7a5667aa964f69d3c4
SHA1 163c2a65e900a59efa26a979a1efb2c4a4a99e70
SHA512 70426e085c1953b13b86552ff5df38c35d580145d2750283c3b518c563f6ebfbf0b3464447ba8611c487213e63880ed1108287f45e5bfd5efe3e256cc3c2b436
SSDEEP 3072:QtLn4S8GqEYfMFgU+0RSlbywsmJdAv91++J3qUQm08KMWF0bFTcVHr6zn:OwGBH944z++JjcMW2VcVLM
TLSH
T1441423F6E80D7C7A179EE6E6801FFC3BC883948F59055A3C30877B2A045D2E3A796495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 e83cd169459837225f60d64438816e0a649925ad489a6e966e807b26fd6723ec
MD5 772682d60b22b57f1ac2d1cfb93074e4
SHA1 992549ee10c4e47537cf8e9018b14c66edd9ff9f
SHA512 d867f36fd970eb1c5eb7136e23b76348c77bc80f652ffc13f61aad081052103ece6ea2efee51bc8b05965827a89d83caddf72510c4e0a515c23bdbc3ada17c5c
SSDEEP 3072:htLn4S8GqEYfMFgU+0RSlbywsmJdAv91++J3qUQm08KMWF0bFTcVHr6zn:DwGBH944z++JjcMW2VcVLM
TLSH
T1B11423F6E80D7C7A179EE6E6801FFC3BC883948F59055A3C30877B2A045D2E3A796495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

New Text Document (6).bat

Path C:\Users\Admin\Downloads\New Text Document (6).bat
Size 476B
SHA256 ba484ec4940386dc952c5f4a42f30f8d29404d240e1daf78521f6cac969b4358
MD5 9c8e3eaf05a0ad18fa84cd3017b355d8
SHA1 7a612076d8354e5cc838280d5829eff9586dd200
SHA512 ddf8588bbefa1e33efe28944d7b95926aa23cce256f5722e303432e58640cf8b08d20d8424ad0d601a0cd2552f06eedff5826ac8f12e4420a6a10b09467e8d4b
TLSH
T11AF0EC1B331BD2A044A060E1093C31CBB622304B5E5DB9E0798B70288B390D232A88AE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-16-0x0000020BB6FA0000-0x0000020BB6FD1000-memory.dmp

Download

memory/652-0-0x000002D85F080000-0x000002D85F0B1000-memory.dmp

Download

memory/1680-1-0x0000017D7DC60000-0x0000017D7DC91000-memory.dmp

Download

memory/1812-13-0x000001DEC84A0000-0x000001DEC84D1000-memory.dmp

Download

memory/1996-17-0x00000295ED620000-0x00000295ED651000-memory.dmp

Download

memory/2724-12-0x0000018A64110000-0x0000018A64141000-memory.dmp

Download

memory/3924-7-0x00000264208B0000-0x00000264208E1000-memory.dmp

Download

memory/4432-11-0x0000025259500000-0x0000025259531000-memory.dmp

Download