5eba5b6b1dbedcd7db79a7bcbb4a0abd58cb14c0538f12d7fd7b3722beed3d06

Analysis

user interaction
yes
max time kernel
900s
max time network
874s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/07/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
smartscreen.exe
Size 596KB
Sample260712-2j89hsbw21
SHA256 5eba5b6b1dbedcd7db79a7bcbb4a0abd58cb14c0538f12d7fd7b3722beed3d06
MD5 840d5571de5fa889dbd28fcc41e8fffc
SHA1 98266ab0ef2146eb396f087d9b5a2f5a25bb3727
SHA512 7d27ca9a388caf81b64ba097061f9dc78485fe17277f91cb31085a92d0a463ae8aa617cc0ce355b352e48dea5118a12e66cc45f5120a495794580ecb294ceb9b
SSDEEP 12288:Ht9OevGd37vbbpm4cJcuKoEKf08tsh4Nnv:N9XGh7vUVubh4Nnv
TLSH
T1D2D42C5E66AC07E1E17AD07DC983460EE6B178355332D7CF036142AA4F27AE85F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1844	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283695079259606"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
1496	chrome.exe
1496	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2160	3092	chrome.exe	92
PID 3092 wrote to memory of 3500	3092	chrome.exe	93
PID 3092 wrote to memory of 1844	3092	chrome.exe	94
PID 3092 wrote to memory of 3500	3092	chrome.exe	93
PID 3092 wrote to memory of 4552	3092	chrome.exe	95
PID 3092 wrote to memory of 4552	3092	chrome.exe	95
PID 3092 wrote to memory of 1088	3092	chrome.exe	97
PID 3092 wrote to memory of 1088	3092	chrome.exe	97
PID 3092 wrote to memory of 4848	3092	chrome.exe	98
PID 3092 wrote to memory of 4848	3092	chrome.exe	98
PID 3092 wrote to memory of 688	3092	chrome.exe	99
PID 3092 wrote to memory of 688	3092	chrome.exe	99
PID 3092 wrote to memory of 2036	3092	chrome.exe	100
PID 3092 wrote to memory of 2036	3092	chrome.exe	100
PID 3092 wrote to memory of 4376	3092	chrome.exe	102
PID 3092 wrote to memory of 3216	3092	chrome.exe	105
PID 3092 wrote to memory of 3580	3092	chrome.exe	106
PID 3092 wrote to memory of 2692	3092	chrome.exe	107
PID 3092 wrote to memory of 1496	3092	chrome.exe	108
PID 3092 wrote to memory of 4208	3092	chrome.exe	109
PID 3092 wrote to memory of 4208	3092	chrome.exe	109
PID 3092 wrote to memory of 5048	3092	chrome.exe	110
PID 3092 wrote to memory of 5048	3092	chrome.exe	110

C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
"C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
1⤵
PID:1708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffbb9e2c728,0x7ffbb9e2c734,0x7ffbb9e2c740
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,11358820199635948771,14835747422685175811,262144 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,16866860747471671704,17016088942291255220,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,3531013591834839155,13106577860968150721,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,17892233066304515056,3536030807705145427,2097152 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,14738452879881608929,8081348659606082180,2097152 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,810551491167791651,12122192467484985437,2097152 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,14988728527271120013,17253349395244462560,2097152 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,890449475695378275,6828279455174168882,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,7387166302287113446,16352894233216958858,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,4889071695092373339,10576094363125121804,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,17550635470149223450,17320072405152255023,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5688,i,645800760984967253,8296417568904249588,262144 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,13557822148284441687,17692417117284081438,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,17419694994329692554,6566002870099565217,524288 --field-trial-handle=2104,i,11354007978742511627,13303454994550755875,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x2f4
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 280fcc8cc017de365103f0d8c6c050302ea788cd954e319f9e4c4d3b8aad3260
MD5 69bb3246beb820a0691a2cc7918339a7
SHA1 eda76202a9e74fa660cfafd83d48261bdf77eb5c
SHA512 c8ac560e1928194d01c79615704de76074a4d6812b5348869ae9fc892f02e84dcdf1dee1f708dfa44bd41c390987cadd2d3182ca989400f29ba6f37af2fc11a5
TLSH
T1CFE02BEAC911EC2714FD072965459782E654135B2B40591F7B3CA60D4FB067A454681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 89d8954fac2c7c5be186516f6dbbdfaa34ea767a6548d300538d55ed90a43c31
MD5 08efdc18ff9d11b1764d301d2d8dc433
SHA1 1c909ac28f30ebeb9101dac65ea20fee482da85f
SHA512 44661188825a60a52b593db092d16acc43e0a100626c4b28ddb48de324c22d99d9957800cd19db066354db006db9545510fe3761a1a2e80ba86997c7180c5f73
TLSH
T17D51BDF7D3E48A7EC90196F4DB116E1FCD290A24132C3C6688D4AE1B93E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c3b722593f75b407347feb86ebda92a3bb0dcd60855eb39ce6f120967369efec
MD5 3a862b414ce120fbae0a270534714761
SHA1 2a5276cd2c73b373ad5b48f72a15d5d9a228fbbd
SHA512 10610f4d23dec2752a40557c554e12bb4fa932622d422077d80f966e33475d75de2d61e175aecba116b6edf818e20fea19bcf3b5471faf40d07d539fca638aa0
TLSH
T1BE51AEF7C3E48A7DC91156F8EB116E1FCD290A24532C3C6689D8BE5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 57d49da4500b871ef464cf02b2960265a1cf6616641f1a4053fe60685b25c7a4
MD5 4782f687b00647a5fa8530a05534c2c7
SHA1 7c56aa1b334443a56aabc537d19dc1dbc2865c77
SHA512 4077e0e648ee62ae209e5da5bbdb07eff05a58dd77d96f31703f985274d754b487d49d25af8f13a4d4a996bdc0f72f30f3e6e2d56813a01074546a53cba40d9b
TLSH
T13151BDF3C3E48A7D851152F89B206E1FCD2D0A24531C3DA689D8BE5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fe09e7d001441b66b69bea06a4ee1edfd3c7f83a4f95ab3c18480dadd0d011f2
MD5 2aeab8eb1e8d62b4f4acb16f9adbd24e
SHA1 f3c328eaddc060ac4ca44be46bec8af6396545f3
SHA512 797883631f704d3601ebd078c375421e292262b694627900e96dee1ae8419d3b6989885d0b45e647211ff87c265ff36b4a808ed61acdd23ff46eaaf6e26eb31e
TLSH
T13D51BDF7D3E48A7D890096F4EB116E1FCD2D0A24132C3C6288D4AE1B93E2972D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fcb3cfe0339de6e762a6e81e8014a78e3bfd7d9b7fedef332378a90dc2dcefde
MD5 330efb2517e88dd720a694912d727d4f
SHA1 8657843e75d843dbb0ec958cba1ccebc3e070bc3
SHA512 ca3d656eadef280ace73819cabc512bd5053bbfed1286906492d9c983011fb22530209cac56b56a6808bee5bf90cb658c177c951fe798e7cd9ebe88de503cc46
TLSH
T15851CFF793E48A7D850092F4DB116E1FCE390A24031C3CA588D4AE1B93E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 fb8540436b08b85269949bc147f5fa0ea95eec605ed1d7b30f69e971e8e10b9b
MD5 1ad59eafcc092e47abd07c3740daaa54
SHA1 6f48d9288a0d26b319b2925a8a50b161d3513802
SHA512 b1c0629c036068fff6f89f8ae1cfe986bd41e43c174fd400d2c902f25c8165fffbfb97d81c8a91db2f88c7e1c0abb0a978bfd6aa2a7c110851e5121c53c0775b
TLSH
T1A5F059E7AA79746350B9867F1E047D0928F6B43002801DF8CEEA826EE0805E71F03017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5bed6876e81fd2ecacc1fe7446e66588bc31063cc6fcaacdcd5cb9e1d65153de
MD5 bf7b142aadf57ac271ceec967e8af60d
SHA1 0a5b4c46361c48466509c6704a938b3fa58764ec
SHA512 96b6b70e3cfa7f7ac634463059d99fb8eac47d01efb017d7943fa566a9b551f1f7ae2e7737dfd49084dfdf6b76b616df276fac17bddd75d3e134bef1b78c645b
SSDEEP 192:iQRQKU1A5nhEo/thl+XOv7TpAPRp2v99Hsb+WNnQoMD0lIBoz2i1Qkwn4HVyIsnH:lRwCDb3UX4jw00qk2iC68
TLSH
T18942E72EAD10793B5CDAC21AFA617B57D7F5102226D02E88EBFCCA2C15E75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef50593f3718e070f3d01bc8641a28789b04ed6974ce09d0d398c405ed02fe40
MD5 8ff2da4dda237710288bef43e5d59306
SHA1 929eefd6044ede707af939b499a55128b78f4613
SHA512 832474b2e6431088e07cee7392ae3db6056d77d33790b9b8cf5da978c294908e0d2ea8246e64709fe92f9e1bf64c55dc398265ea3fd1046c4e058aa8cae0972c
SSDEEP 192:iQRQKU1A5nhEo/thl+EOv7TpAPRp2v99Hsb+WNnQoMD0lwoz2i1Qkwn1HVyIsnAq:lRwCDa3UX4jw00D2iCPe
TLSH
T1B342D72EAD10793B6CDAC21AFA617B57D7F5102226D02E88EBFCCA2C15E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 da7dcdf00d26d7ee8a89aca6147ce7091f0e208171b68d3d040a829bb7dc364c
MD5 ced6291b65cacd18f82f432c53e11512
SHA1 c414e1476a83f61f56eb54a9f9ddae0f2384bae5
SHA512 c1b8d9e0d097121080cc880db2a12cb294dfd11a767400c1d72b9c900df01462b2ebffbf944fb83d0ddd9f395bb9a821e539ed08fd1669124e063cf752e866ee
SSDEEP 192:iQRQKU1A5ThEo/thl+EOv7TppPRpFv99Hsb+WNnQoMD0lgoz2i1QkwnrHVyIsnAq:lRwCPa3zXZjw00D2iC9e
TLSH
T1E152E72EA910793B6CDAC61AF9617B57D7F5102227D02E88EBFCCA2C15E75DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b99179c35c3601563e3f8f7c27ad17260e8c52a379bfba8211a2140bc389a744
MD5 0e77f4f9ee6a004129a1293e72c4d5c5
SHA1 3aa217a1a9722458ab1756914b5e13962e4f1777
SHA512 0dc16cbbdde60eafa81b79e63dc8a8d8c8bf96530d6a0c4c450351866ff3c67560faaf8335014c228753dbd86302300abf9d4ae249f15a4eda59495424dd6261
SSDEEP 192:iQRQKU1A5ThEo/thl4zOv7TppPRpFv99Hsb+WNPikikWV/tNAZTV3oz2i1Qkwnrs:lRwCPiG3zXZjwqRpV/tqlV+2iC9e
TLSH
T1DC52D82EA910793B6CDAC21AF9617B57D7F5102227D01E88EBFCCA2C15EB5DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ee1f4a1e2eb2aab1791d4536f047232498b6c0c6b5a4c0c7ece3ddfbf6e26b89
MD5 f5e617154043fd8aef7a5c66bd953575
SHA1 f5b6c6155233a4187d07666d9de2c02c3689f5c0
SHA512 747c10bcc09edde2fbb8daecec74c8f4bb82e560ea8b50858835b37f25726d9d55fc8ab41d56e6a545ec63efb38e5825edaeaab1b49923a2b03f6b83183edd2a
TLSH
T14DB012419001B101C0420BB43582189C71146F20A60A170543E46B26C8256718414091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5898c0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5898c0.TMP
Size 96B
SHA256 2dfdc5186524c5ea23263ddfa896417afc65fb97773128aa2f6958dc23ed0240
MD5 6b8a166610a6e6009c343f416d8fe140
SHA1 9fdbc615963d315cf8db6e8ce02aad864362d51c
SHA512 99ccd256749303e9f195903ce0b390cc764a95e88587d7332639683e15663e12dd23fdbbbcd54055ba28e78e279ebb6d27dafd2ad7e5b639e4c1de1e054c83c7
TLSH
T1BEB02208C00A2B22C00303F2388280E830A0EF22C203020283F00EBACC283B080200A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 05440654e1a99707add89d1f28fbc57201bfaff78737a23390ca22598234bf1f
MD5 8f0669d7c72c5428f4156d35d9b879da
SHA1 bc7a49b9d614cc8340218f57a6cba1908b54e679
SHA512 ae092c6a9c1af2b1b0a9fff3afe721f154dddc2a418c555681cc576b7ad3c92a222c1a432fed263cc543a9f537474d972fdce92efb626ba275d71a0a72b95d4b
SSDEEP 6144:hxTCe0T4THtKE+1HXlKM0S3LfqBZqenbyyVEd1cB1l:hxl05X0M3LCVDuenl
TLSH
T100341231AA37FF6AE1399736F50F6B0F9DD11BAA44A1A2C4443D3F4D84C6244DAA394C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 0feef04b8688e686850a3b771d2aa5361c2087fddfdd767dc62f6221667095b5
MD5 4c007223e9cbdfe7aec2782da5f20f77
SHA1 3839e7a21efbc1da112db8cc99651d898eccf38c
SHA512 52eec7ca6c376789d31293d2d8efe2c6cff0f5fa8092a68b9d3f8c7da44cc9384ce2db5faf25fe00b7255e265a83c871dff15c786dcaca4a7b38818de303bee2
SSDEEP 6144:sxHCe0T4THtKE+1HXlKM0S3LfqBZqenbyyVEd1cB1l:sx505X0M3LCVDuenl
TLSH
T1F4341231B927EF6AE13A9725F50F5B0F9DE157AB4490A6C8483C3F4C81C6248DBA7948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ac72b5990997208a517b31ffd51e5b3d0ec551aa36be9fade8c67dbb834e3986
MD5 d754f902ac767e4253a292e333a0cabd
SHA1 442d2443d49bf233f79286e5538d9a2987125a9f
SHA512 aaf6281d4ccadc1a9c6a3fe97fe4341bf711b638f5d134e2d8d333740e9d5609376cbac985b3b1a2e79d9c6d5da08329614cef3ebab067dc004b4ebd12ce39d2
SSDEEP 6144:MxHCe0T4THtKE+1HXlKM0S3LfqBZqenbyyVEd1cB1l:Mx505X0M3LCVDuenl
TLSH
T150341231B923FF6AE13A9725F50F5B0F9DE157AB44A0E6C8483C3F4885C6244DBA7948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cdb6b317ffb51884385a548c346ea39e14d6fcbf17622e4c1c54d268ef7bae24
MD5 9debab7e47e9753a2bab99eadbb30b62
SHA1 36638c4d9278248b2d8699dde24f165aa1c1b626
SHA512 a90ff22f1f583dcbdb71ad52ec42d906cd51d483226644c6c1c895a4b28b423bc86589a21191c8066323eb21c0e6ed56f9c65224361907cbe1f519dd0d35060e
SSDEEP 3072:IxKw3LffUnBKU/F8enCW3iyVEXGey0cB12:IxJ3LfqBZqenbyyVEd1cB12
TLSH
T1A9B31221E4A6FF7BA275572AB50F93295CD148FB44E1E788443C2F19E0CA388EF98D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 3a6687918bb0d88127b1355627a5b4dd87e2b2c21ea00d9adecd920dfe4d96e3
MD5 78a413c5d44a88b885f180ecf236b464
SHA1 7bf0d576a4fb2ae6bf617b61342e7c95711f2ac9
SHA512 3727b8a9012e5f8ed50abd8b24a152a4bd33694fca9441ed855c38f58da66e2c1957f96e944d8e346d4aa564e7e7a00a610ca203777c19b6b43ccde7bc689dca
SSDEEP 6144:MxTCe0T4THtKE+1HXlKM0S3LfqBZqenbyyVEd1cB1l:Mxl05X0M3LCVDuenl
TLSH
T1A5341231AA37FF6AE1399736F50F6B0F9DD117AA44A1A2C4443D3F4D84C6244DAA394C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download