f0e70ae8697eb0768a14fa2e36c4f1c60c771b0e056e529d8f4abe6f68530ce5

Analysis

user interaction
yes
max time kernel
60s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HWiNFO64.exe
Size 10.3MB
Sample260503-k32v4set9t
SHA256 f0e70ae8697eb0768a14fa2e36c4f1c60c771b0e056e529d8f4abe6f68530ce5
MD5 9e3a527fd9d428d4ef75bfce7342d365
SHA1 896960075fe1f54f2c68fbf1e44b8b2da4c15848
SHA512 4ac2787f35f2d9b60b548b6f3b27b76208e1015906e430ce1cc1d6b6bc913d54a371f88b3e188dac5ff1375086e9abd6f0c21e52c13b911079761b22e3692232
SSDEEP 196608:a+wbbki++h/wF01C5omvZT6Fguh0a5+fjbpsqlg1UkkbIlk8j3EW4e:VCbfvMQR5eXTIlHvd
TLSH
T19BB633FEE3357802C21C0DF6B4123B7463B96DA2AD086B67016C348DE9BC167F65532A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3988-0-0x0000000140000000-0x0000000141E97000-memory.dmp	upx
behavioral1/memory/3988-2-0x0000000140000000-0x0000000141E97000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
608	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222729509659881"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3988	HWiNFO64.exe
3988	HWiNFO64.exe
3988	HWiNFO64.exe
3988	HWiNFO64.exe
2424	powershell.exe
2424	powershell.exe
2200	chrome.exe
2200	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
752	WindowsTerminal.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3988	HWiNFO64.exe
3988	HWiNFO64.exe
752	WindowsTerminal.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 752	2480	wt.exe	81
PID 752 wrote to memory of 3776	752	WindowsTerminal.exe	82
PID 752 wrote to memory of 1228	752	WindowsTerminal.exe	86
PID 752 wrote to memory of 2424	752	WindowsTerminal.exe	87
PID 2200 wrote to memory of 4680	2200	chrome.exe	89
PID 2200 wrote to memory of 608	2200	chrome.exe	90
PID 2200 wrote to memory of 532	2200	chrome.exe	91
PID 2200 wrote to memory of 532	2200	chrome.exe	91
PID 2200 wrote to memory of 2536	2200	chrome.exe	92
PID 2200 wrote to memory of 2536	2200	chrome.exe	92
PID 2200 wrote to memory of 2164	2200	chrome.exe	93
PID 2200 wrote to memory of 1780	2200	chrome.exe	94
PID 2200 wrote to memory of 2164	2200	chrome.exe	93
PID 2200 wrote to memory of 1780	2200	chrome.exe	94
PID 2200 wrote to memory of 1392	2200	chrome.exe	95
PID 2200 wrote to memory of 1392	2200	chrome.exe	95
PID 2200 wrote to memory of 4472	2200	chrome.exe	98
PID 2200 wrote to memory of 4472	2200	chrome.exe	98
PID 2200 wrote to memory of 2916	2200	chrome.exe	99
PID 2200 wrote to memory of 4440	2200	chrome.exe	101
PID 2200 wrote to memory of 4440	2200	chrome.exe	101
PID 2200 wrote to memory of 4120	2200	chrome.exe	102
PID 2200 wrote to memory of 4120	2200	chrome.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HWiNFO64.exe
"C:\Users\Admin\AppData\Local\Temp\HWiNFO64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3988

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
  wt.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\wsl.exe
    C:\Windows\system32\wsl.exe --list
    3⤵
    PID:3776
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa04 --server 0xa00
    3⤵
    PID:1228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de9dc728,0x7ff9de9dc734,0x7ff9de9dc740
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,10091560597888578190,1939506874070675014,524288 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,12708572653006761037,12481859030072152608,262144 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,14001371395330352561,6285825054355266626,524288 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,2311289488740945747,4672304673672007428,2097152 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,4163164515097813320,13452811026742676355,2097152 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,14837703042288991017,9348075731413725571,2097152 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,6510414983802144780,17507181505863040525,2097152 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,16956396131370369466,7134986312649849424,524288 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5668,i,15485500987826707876,17440444563193370202,2097152 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5376,i,3257981218435641452,6773519665102680037,2097152 --field-trial-handle=2164,i,7588550329612077587,12138255597107024645,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e382dc1a477dfa3da2b86f943ccf9d78a8341e063cdabad792aa9d4ca2706ef6
MD5 5d02c8991cdb2cdeb37a7f30205391a9
SHA1 997ee2d31706bc539c62fd488dea83b668548538
SHA512 99e8e363592b08327f3297c1032c84d1fc95ab99c7475bb4816e12c0cb49d6ec39a53ffd566dca3e52cf7ef2c073f322394ef28d2b659e885ab857b8532fde41
TLSH
T114E022AADC22EC2B08FD0B2A61104BC2FB4403576B4189AF3A3C810D8FF063B41D982C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 d1f70dd99e2bbdecf0be214ba78688eaaace2803254cb37ca35aea1512b3553f
MD5 7b9adb6bbc9a8b7d93bdf0182c52b9a8
SHA1 7c932405d4c1911ba2bc273616140ffce14b9436
SHA512 5693500915ef53d4069ea90d4a9b697e93a1ab08176f2f81afde2dd524bda29380dfe787b7fa8e3f985e087e4ab2853fb388513942af82e5869216599a41ed3d
TLSH
T168D022109FC30090EB9C0EF00C9EBC2B30300E19022B83279BE8E0C4EC463E03972A87
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 947e67e7a7b7768c698edba2675d58926056e388650bf3ec8d43b40e8f72afeb
MD5 9c1095e21c62d153e0e272e5ac02f52d
SHA1 88edd00947889c445ef31ba426b602ee1d44a696
SHA512 6f19c2a312cb34888f9b81b55bc666a934194cce4d00d3091fc67bdd36c44f4e1c4d49b2d9e617a12155d04e67fe81b9ed06dfcb9b161cf8a381dd8070cce651
TLSH
T16A81C0F783F48A7E8911A1F4EA156E1BDE6D0515032C3CA2C9D4AF0B57F2872E24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dbb0fe0a-35a2-4d40-ad05-3a06369f2a13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dbb0fe0a-35a2-4d40-ad05-3a06369f2a13.tmp
Size 523B
SHA256 5b4830b2fad9f0d34ecc966d3e3a7d5b6e32dd3ab30079d08dae841f26e64617
MD5 7ac9f5ac58e03c14818414a6b301d9ac
SHA1 16f2abdb0fc45965c77b2ec073a54543101ff5ad
SHA512 490ac6204a05b98686e556ec70e9cd7ab7b71dc4674871e6995b68d1e4947e5fac2df3ce4ef2721f8417857ed2cc7a7e2af7ef5d76a9892881c890930c7cad7c
TLSH
T145F0C9A3AA7A783F18A906AE1E107C056CBAAC3A018158F0CE9A813C90459F30F0340B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9bbf7a423ddc16e11fbcda0a65cf187e3169a76d5fce0564d3871fedb2582478
MD5 87794906d9547f9d2fab804a075dd74e
SHA1 6d249221bdd788f2160384a5dae580165e5dfab4
SHA512 01379156f571c02ced46d8b1ace44706199b6a90ff84fa9070f9d839783f39151e6ca92bcba5775be631eeac99be7488207f3ea286bd1c1803668a195351b6dd
SSDEEP 192:lRqoruBPU9+1x+4Mv7dhAPRp2d9ZHsb+WNnOd05teRJT2qCCCVyIsnAUgtaJ:lRxruBu+TYp8XGHwc0AJT2qZC8
TLSH
T12142C82EAA60683B5CDAD219FD61B72BD7F5102271D11D84EAFCCA2C14E7DCC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0bfc963725369ee84e4142ed358bec109a2e6f6ba78eb0a4ae3d20883bf850fd
MD5 1b5f5a3032f246743f5b8cbe05c20a13
SHA1 724a33c3d03ed0c258850298db6cf97082154290
SHA512 66679055db8e3f666e25460cff515265ad39c014f7a4493370e17be9905312155ffc1345a49c9e6cc9d234ff71609bcceaafffe2943d2caa98bf7f254aa7eee1
TLSH
T174B0122080019521C07302B411C648E831345F149707130153F4E9B5DC271E14036250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c484.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c484.TMP
Size 96B
SHA256 f654bcf5c9fc14a8482dbdef33778f3df730cc235c556e82eaa63d5bef697089
MD5 7e72203fc5a1b327d711bd0f36fddf2f
SHA1 757424a0744ba237fabb64b77d603f78cd322152
SHA512 afe9738f31fba95475c55853e5b07637ae24440d0657b6abd211769474b0017fb2ebb6d429401ebb5f6fc15b5c920553ed61c7a6f3b42f0169b7a2bdda400473
TLSH
T19AB0220EC2022A03C0C203B022A8E8C83230CF20C303020282E00EEBCC2E2300032030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 3b5ed748031da5ca87e735513b3ec008bb5e6c38edec46188c1dd2558f8a178a
MD5 0a9e6bd836aa0d886a7974f99a15c1c9
SHA1 42d90911f6ab950094e34eb3b334d36034ae0293
SHA512 8a5a8c10436bffece88f807ba7a58120bc3e3de65624bc83395b1233d1ea1f6f11e5fe6202d2155e6dff4458348fc169016302ad49d8f547b8762090468d6051
SSDEEP 6144:7kRxx+5VwBbR6GoUGU6Ys++JjcMW2VcVLf:7KS5VyzoUGUoOMW5
TLSH
T193141272BF1B7DA5836FC7B7750B8C588DD388C94600A678529A6F8609F47E383634B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 13cb7d24c97bb475906163f63392f1b7fd7fc72d2b9b823d897e37c8763dcefb
MD5 07c8a588742b9f79f02128053995ef4b
SHA1 73671ee78467b9e866ad76f7e85a856949583bed
SHA512 c14313062bd862bd88ba7c742650047702174ee01668dced5b02fcaaf8f094581534a46572c45e757d1d08979840045138453c710a3a797706ec52e103253c1d
SSDEEP 6144:gaRxx+5VwBbR6GoUGU6Ys++JjcMW2VcVLf:gsS5VyzoUGUoOMW5
TLSH
T1B2141272BF1B7DA5836FC7B7750B8C548DD388C94600A678529A6F8609F47E383634B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6c517058f2526b21396fa114df019274c16df27646de7c804c73b3c844a08c87
MD5 5581f7bd5974785229b7e77a3d778d31
SHA1 209f1a5eeecb301c98140b0f3d10941f69adff3b
SHA512 d755c4803e755236aa52851b8070243dda24a96d26db5b63e8b6148f622da6ae61a8443c03a71ce7d5e9683e7555642b230e856f2bcee1f55891b43c429bcd27
SSDEEP 1536:XhP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:Z++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1429302B9991E7C79536BC696A0079DAC8CD3DCCD111451BC30C76F0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_b0wecbuz.b5k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0wecbuz.b5k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-14-0x0000025F3CA00000-0x0000025F3CAAE000-memory.dmp

Download

memory/1228-15-0x000002C00A0D0000-0x000002C00A17E000-memory.dmp

Download

memory/2424-17-0x000001D6412D0000-0x000001D6412DC000-memory.dmp

Download

memory/2424-18-0x000001D641390000-0x000001D6413A2000-memory.dmp

Download

memory/2424-13-0x000001D659A90000-0x000001D659AD6000-memory.dmp

Download

memory/2424-12-0x000001D6599D0000-0x000001D6599F2000-memory.dmp

Download

memory/2424-16-0x000001D63F8F0000-0x000001D63F99E000-memory.dmp

Download

memory/3988-0-0x0000000140000000-0x0000000141E97000-memory.dmp

Download

memory/3988-2-0x0000000140000000-0x0000000141E97000-memory.dmp

Download