hxxps://dg01[.]redatatech[.]com/onprem_image_fetch?dep=kLAH%2FkMSTS0fmu6a1ikFeQ%3D%3DGpR2NY3Ye%2Bzs6eLzjN54h8eYdNdkrEfq8pLRU2Wj05xHjUG52k1pCcEismLQjMk6Mp8K%2B6j3l7cO2Yx42mc2WuPLwFZ7otE%2FkyPGeJHOrEKH%2FnVF7w1y8B07TSV6P1rB7NIHtMi8WbM7vEM%2Bzb2JZEJreOicCOQNmgj55sO7md73d31bWOC2ogCuommTMr9eCbLEmtJFc%2BLsDPohO6mIeVpBJva7LF3LeSUUdbnB3Rtc1ymkfzldbC7L51YWIgfyBovO4j1lLKrS7VUsxOJydbMNBuL1YooG1sddMCzyZteBgrd%2Bd6bUiT4K5FZnLAZwySU0yBVHDUXqrT1Jly5IqH8FpBEH7Y87%2BkIESpF2Sx6LRR3KdkH2COu2pYwXgV6SwEWh3Jk1OP49hQ1J4hVGIJ8fyhWImnInsHHmAd4eKgzQLBIjTuEa1PX%2FG2YovzgsY%2BZiWayAxcWsJFYvg%2FDdyo9%2BZP2OIdXjgXJSSSf5rOIodJWgJurKTlsMOZ1raakY7KIgRmp0paTizJovGOuPpic9clr5boSJfjswJ9oAuyY90v5qmWkPjL8xied%2BxFbW7QuWRsVauAyy7wnsn5FWnmiikEtiN%2F7ut69Gc6YBtx0%2BKWQFfIoLlR28qbea%2FKwgfcMFcCW%2Bnxx9qMbiNaezEN3mAEo6oZCkmMOWB%2F94VAZBojrrMTTSnXF5%2BvSOZIxg8gs8Pt4NeS7BeoHkeyaQOWTdVTj1gUr1jsn%2Fm8daRQptDT3xoqbV6MRycADqFA8P5S0E2wYTkUWw8qG2cyz9lw%3D%3D

Analysis

max time kernel
305s
max time network
310s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dg01.redatatech.com/onprem_image_fetch?dep=kLAH%2FkMSTS0fmu6a1ikFeQ%3D%3DGpR2NY3Ye%2Bzs6eLzjN54h8eYdNdkrEfq8pLRU2Wj05xHjUG52k1pCcEismLQjMk6Mp8K%2B6j3l7cO2Yx42mc2WuPLwFZ7otE%2FkyPGeJHOrEKH%2FnVF7w1y8B07TSV6P1rB7NIHtMi8WbM7vEM%2Bzb2JZEJreOicCOQNmgj55sO7md73d31bWOC2ogCuommTMr9eCbLEmtJFc%2BLsDPohO6mIeVpBJva7LF3LeSUUdbnB3Rtc1ymkfzldbC7L51YWIgfyBovO4j1lLKrS7VUsxOJydbMNBuL1YooG1sddMCzyZteBgrd%2Bd6bUiT4K5FZnLAZwySU0yBVHDUXqrT1Jly5IqH8FpBEH7Y87%2BkIESpF2Sx6LRR3KdkH2COu2pYwXgV6SwEWh3Jk1OP49hQ1J4hVGIJ8fyhWImnInsHHmAd4eKgzQLBIjTuEa1PX%2FG2YovzgsY%2BZiWayAxcWsJFYvg%2FDdyo9%2BZP2OIdXjgXJSSSf5rOIodJWgJurKTlsMOZ1raakY7KIgRmp0paTizJovGOuPpic9clr5boSJfjswJ9oAuyY90v5qmWkPjL8xied%2BxFbW7QuWRsVauAyy7wnsn5FWnmiikEtiN%2F7ut69Gc6YBtx0%2BKWQFfIoLlR28qbea%2FKwgfcMFcCW%2Bnxx9qMbiNaezEN3mAEo6oZCkmMOWB%2F94VAZBojrrMTTSnXF5%2BvSOZIxg8gs8Pt4NeS7BeoHkeyaQOWTdVTj1gUr1jsn%2Fm8daRQptDT3xoqbV6MRycADqFA8P5S0E2wYTkUWw8qG2cyz9lw%3D%3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544030326236721"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
324	chrome.exe
324	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3396	2144	chrome.exe	95
PID 2144 wrote to memory of 3396	2144	chrome.exe	95
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3360	2144	chrome.exe	100
PID 2144 wrote to memory of 3932	2144	chrome.exe	101
PID 2144 wrote to memory of 3932	2144	chrome.exe	101
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102
PID 2144 wrote to memory of 5012	2144	chrome.exe	102

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dg01.redatatech.com/onprem_image_fetch?dep=kLAH%2FkMSTS0fmu6a1ikFeQ%3D%3DGpR2NY3Ye%2Bzs6eLzjN54h8eYdNdkrEfq8pLRU2Wj05xHjUG52k1pCcEismLQjMk6Mp8K%2B6j3l7cO2Yx42mc2WuPLwFZ7otE%2FkyPGeJHOrEKH%2FnVF7w1y8B07TSV6P1rB7NIHtMi8WbM7vEM%2Bzb2JZEJreOicCOQNmgj55sO7md73d31bWOC2ogCuommTMr9eCbLEmtJFc%2BLsDPohO6mIeVpBJva7LF3LeSUUdbnB3Rtc1ymkfzldbC7L51YWIgfyBovO4j1lLKrS7VUsxOJydbMNBuL1YooG1sddMCzyZteBgrd%2Bd6bUiT4K5FZnLAZwySU0yBVHDUXqrT1Jly5IqH8FpBEH7Y87%2BkIESpF2Sx6LRR3KdkH2COu2pYwXgV6SwEWh3Jk1OP49hQ1J4hVGIJ8fyhWImnInsHHmAd4eKgzQLBIjTuEa1PX%2FG2YovzgsY%2BZiWayAxcWsJFYvg%2FDdyo9%2BZP2OIdXjgXJSSSf5rOIodJWgJurKTlsMOZ1raakY7KIgRmp0paTizJovGOuPpic9clr5boSJfjswJ9oAuyY90v5qmWkPjL8xied%2BxFbW7QuWRsVauAyy7wnsn5FWnmiikEtiN%2F7ut69Gc6YBtx0%2BKWQFfIoLlR28qbea%2FKwgfcMFcCW%2Bnxx9qMbiNaezEN3mAEo6oZCkmMOWB%2F94VAZBojrrMTTSnXF5%2BvSOZIxg8gs8Pt4NeS7BeoHkeyaQOWTdVTj1gUr1jsn%2Fm8daRQptDT3xoqbV6MRycADqFA8P5S0E2wYTkUWw8qG2cyz9lw%3D%3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eac29758,0x7ff9eac29768,0x7ff9eac29778
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 --field-trial-handle=1892,i,11368253668946926460,15822017206214245696,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
04e6ea026fe62f9f131e2a738fa09f51

SHA1
c8938c0d110115c7674adc788a71efb54d4c32d5

SHA256
fbcfafe36d65b08ae8d8de508b669d0c72774c4cb787eeb230873d3b240366c8

SHA512
b646ff17e4aa3b4c07495fe66de88b9b9d41419275a67d78517e13ab22796a24361317afafdc4ade43b8bf2902031625d592894647947fdb84dbe6b99c1ffcb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a73fbc174ac3ea55155f7a0cd0d446b9

SHA1
2f8039f18141ba799cdc241c3c0499f0338e8e05

SHA256
e1d5272c97367e27527d1f087f9036730f8768d25fdc58d950eaef485654a86d

SHA512
a80969b458ced1b397d625407a610fb5239fd24ea431bd31d104c294f410ea4ab8bc131355fe140cbd3231ba57792e4bc587c47e64d564856f2cc99a7d45988d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0d903b1c23c50a8dd003fc6b0b261259

SHA1
dfbc2cdfc6789d3a97cd93838b6a45387a1f69dd

SHA256
134db99e9bd90b3f356c4ff2403d8f50fd80e803fa8e7a7643d1241851d9835d

SHA512
4df04f52f00df5188b75b71517cab92c5aa0423b00004e98819be2697b041b2e7145186142e53ffc2104cdaeb7e4810d7b84d8ff89a368fe60480c0507eb313d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
fae21ba0a6a36677d1777f94f93cd379

SHA1
358f778ad774e725e83e633f864463805288b7ff

SHA256
0b06a739ff6d8371493a0507abdbac1a6a8598b6bd3034d11628d3c3f08161a6

SHA512
ae85ecc4afdba79914dc82d2ca1ac559e9e660a1c415ac429b8e6e1f89c7e68b555563c5c84309f09b54f20e57bff29355769cc7de5e92b726d3de2192d9d66d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
b3c1b92ef9b897d153a24880ebf1097d

SHA1
346f0a82e18ea82230d92a1113ee7aa6ebac00e9

SHA256
1047b33df721999472e2013c6fe75ae3412a2b013b49fd8cada08965272e296a

SHA512
e237832929f7999a6bab90104c13896dc32669d09b2e7dc4224da967f01add2e44a1588df02e799a9ed2921000c91637f4e04af8cb2ebfb6027e44534e4fec91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit