hxxps://www[.]bing[.]com/ck/a?!&&p=3b853cb72f7f4f36JmltdHM9MTY4MjU1MzYwMCZpZ3VpZD0wNDVjZTI0Ny0wZGFkLTY5YTktMmI1ZS1mMGI0MGMyNjY4YjEmaW5zaWQ9NTIyNQ&ptn=3&hsh=3&fclid=045ce247-0dad-69a9-2b5e-f0b40c2668b1&u=a1aHR0cHM6Ly90cGFhZHZpc29ycy5jb20vMjAyMS8xMS8wNS9sZXNzb25zLWxlYXJuZWQtZnJvbS10aGUtcGFuZGVtaWMtaXMtaXQtdGltZS10by1jb25zaWRlci1vdXRzb3VyY2luZy8#M=dmagd@scangl[.]com

Analysis

max time kernel
1220s
max time network
1223s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.bing.com/ck/a?!&&p=3b853cb72f7f4f36JmltdHM9MTY4MjU1MzYwMCZpZ3VpZD0wNDVjZTI0Ny0wZGFkLTY5YTktMmI1ZS1mMGI0MGMyNjY4YjEmaW5zaWQ9NTIyNQ&ptn=3&hsh=3&fclid=045ce247-0dad-69a9-2b5e-f0b40c2668b1&u=a1aHR0cHM6Ly90cGFhZHZpc29ycy5jb20vMjAyMS8xMS8wNS9sZXNzb25zLWxlYXJuZWQtZnJvbS10aGUtcGFuZGVtaWMtaXMtaXQtdGltZS10by1jb25zaWRlci1vdXRzb3VyY2luZy8#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133293958892555101"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3680	3980	chrome.exe	84
PID 3980 wrote to memory of 3680	3980	chrome.exe	84
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 2808	3980	chrome.exe	85
PID 3980 wrote to memory of 3508	3980	chrome.exe	86
PID 3980 wrote to memory of 3508	3980	chrome.exe	86
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87
PID 3980 wrote to memory of 3796	3980	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.bing.com/ck/a?!&&p=3b853cb72f7f4f36JmltdHM9MTY4MjU1MzYwMCZpZ3VpZD0wNDVjZTI0Ny0wZGFkLTY5YTktMmI1ZS1mMGI0MGMyNjY4YjEmaW5zaWQ9NTIyNQ&ptn=3&hsh=3&fclid=045ce247-0dad-69a9-2b5e-f0b40c2668b1&u=a1aHR0cHM6Ly90cGFhZHZpc29ycy5jb20vMjAyMS8xMS8wNS9sZXNzb25zLWxlYXJuZWQtZnJvbS10aGUtcGFuZGVtaWMtaXMtaXQtdGltZS10by1jb25zaWRlci1vdXRzb3VyY2luZy8#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6fcf9758,0x7ffe6fcf9768,0x7ffe6fcf9778
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4512 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4408 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3344 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3960 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3400 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3968 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2812 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3352 --field-trial-handle=1852,i,17954012253748955984,4831206788193729445,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6efc13de021f1d35ef36db15f900c4df

SHA1
735c81dfe7c6720b36c288325e79e553dc8c3255

SHA256
16315cc1e08d6fbfcdbdd4a4c88a933aa65fb8e4742e059ec504f96535adf2fc

SHA512
e4f3cdb570990b20977dfdb034684c5f69a13ce68ce040a9dedf1f62ea05d888e14483e3176c6bd26ff34d9129907e7606384c6bfef51b67d6845bbcbea7a54f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d3d103727d96a55e009a7564f286a624

SHA1
0442e46addb7546d8b997482bf70b03044d70057

SHA256
645a3be1f03e25d61305c658fb9d1fbc64f4049cc238514a747c5272f85ec04d

SHA512
49e394a902bfeedd8bb98a142ca63a66247410b1010e9ca9d4ff7705a58097d60e437bf514296fa51ea99d88dc079534a24e455257170deb7ac85c64bd74a2ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
958e837194ee282c50e6f41b876492d7

SHA1
b9179cc918ea9a6da81059e9f7744c3b8f5e7af8

SHA256
f9a88d2abae6e5bd838b06101234e3a4d015932f50094875850bbb9d79e69ef1

SHA512
5bcee9c24620d36b4b0992281ca4e63fafea63f94c1b3c082952fc5ee5edb7786e8c858a439951bfc4d4859813efe24a4aa484973744edf7ea258723874e3286

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
04782d0a889edf69ff9ddcf18ff178e3

SHA1
4dad37143e0d274b4c3bbba86fab7786faf83c47

SHA256
d0a173984214095959b57bad874e626258abcf7a8ab52c3b04d5c509aedbe8d4

SHA512
fd06bbc81f1b75b1683ed4aaf48d9e4a4fdebee0375cb0b1c40a0c7ce4229abea745b5414cd26a795de60b8864ab12cb3519486d472b950e14d254e34740ab6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
abcb48e255dd2d98545c7abf41292081

SHA1
8abc715add3cdbeecc0cabc7abf3805164980d2c

SHA256
d12ad7d0ffeee02533024d9ed3836bc1018dcf22cdb8ac52b465fb3625a4db7e

SHA512
983d430252ff08f936340e138205d474ef532a7e26165bf81f316d847e06d6584aebf074b7b07f92fdd0c0b2282a051f61627db51eb7ce43f8764ea4b83ddfeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
035b809b921a5412fca931ac517c9fbe

SHA1
7b0e39be0e984a5f52878ed8e1609174262ee814

SHA256
2e879ab454276da7e9c5f114f4861b1ac1f5139d712fcc4a2667555468bb25bc

SHA512
c6c3b1ac859fad7a22f6cad423165a9739832013190865bc6f02bb554bb1eb4a19ecdd281f5037db4f2297c55632663100b3e47d22d6634b4710c3123b21fa77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
04119b0946a34c274e47de0215bccb4f

SHA1
edda891a1ba7f2b3b0ae3ff77b2911041806241d

SHA256
ec2058a1b4fbf488a5732c0b917e18aa853d2a36b6a280cdb746f895ad99ef03

SHA512
65e05f7005244931055034921775bfe6bb05cb3c65ac4cd9b5e9aaf48ee233a3fa6178363fb38702088b8c8b4386e007d3d46b4137789bce6f15578d9b6c57d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cbc35db1b10825d50979b32d35b0569c

SHA1
36182b808bcd1220b6574439b5a2fe5f4f68d6cd

SHA256
928a66f46386f3a02c3f790de4cf0faba04b3bd06c5d047d6c442706b5054fad

SHA512
170545e080272398e286cd0d16d94cdd77adcf0281a0d0ee3112ddfae9042c451f976972df736124951c6fc671b0c1f96fdec722fe0adf1b2cf4d4856f500b48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c68449f238873929c03a8658ebfb2398

SHA1
2e6ebdfb8ba5a664d2295a758ebccd328978b88b

SHA256
81046edf05400e4ec8edfd5ef8c4e46eff05741ab71cd925766792b7d122c79c

SHA512
c3d083a6275699d0b2b3764a79e26758647758ecc6424e66cc85395926ef7d1295bdc4477e6cd684faf5af6601c401933ada514968871c7074962accfe6ed1f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6e9258c97e4a85747ebc76464f392bef

SHA1
02c201a883b0550f0b0f75b42ebff9ad93bd8777

SHA256
13583c449db145b9a1da06c6a024e9bf3219ccc18ece76317133654ec55f5917

SHA512
283af0190e67e11d35fa9eb0796563dc4a3d2be66eac65926f673a7636904943ca22034ce1bb988d3695d65cc1780fd02cea182f41f5a1c6fd2c11dfd7673f3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
201c917b456e236a3f5cbac1b7444854

SHA1
15907b252cd9f2d645517ecaf744618328eeda3c

SHA256
15890b0e15b06b5d951aa2c76657cc1935bbc066b3478ac39b25e17be34264b7

SHA512
59dc087d2c5e72ce975de14882a5d0003a8e85274c83387ecf82c8cec38fb4a7a4a48a811f02f18f34715609098740d2ef595a466f9150704ee34e6d0521fa84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit