hxxp://url5316[.]atl10n[.]com/ls/click?upn=u001[.]ZqQdlgq1feaOfcwOzw0JXbKavzjOSMVHgS3TqI6RTNnCgPfqWcHl7CNayL4K0-2BCvK4iHWYoKRGxzSBHrE6k6HkZIyDa5CfS8hujtREftCd-2F9g05jaCpD0Ol8-2BZGH42rRZ0lx_xtmRQbq41syJXnvJBBBkmH-2FsaZ1BYaveL75HeMcVtcrKm2vNemgR6p393TwKcBlIGvIWReUp3hWqZ0Fm-2FOD6bhxQ9qX2f64TCLqnkLxC2H-2BkJ9POUkyJZvKcr4Hcdfq9xG2ERAvjlXQFxfEtFqhzDC6J5mOJsm-2FxiMUv-2BbGoc6MyBGoBlly4sX19p-2B-2BGsZTPn51XOkZtliI27XHfqLRIrXZBGukmbiqQLDKKC9rTiZtgTpRZQnb67w9HqmL4h3lJ3hUcwbJRv5akZkkJEoauZtIUApXDvawXjkct8PMEMgSvAMLJbKWO8GHBRzYwmqzEjWw7llqnASoyHdNv-2BwarTy1bc9yi-2FfDN0l7Ct7XFaMMWtV0eTYyRRRo6Xt6MhZ37948dHUhyVdFW7KNUr5B6l1UNxNhRFG9S5f8Tt-2F-2F-2ByJw-3D

General

Target

http://url5316.atl10n.com/ls/click?upn=u001.ZqQdlgq1feaOfcwOzw0JXbKavzjOSMVHgS3TqI6RTNnCgPfqWcHl7CNayL4K0-2BCvK4iHWYoKRGxzSBHrE6k6HkZIyDa5CfS8hujtREftCd-2F9g05jaCpD0Ol8-2BZGH42rRZ0lx_xtmRQbq41syJXnvJBBBkmH-2FsaZ1BYaveL75HeMcVtcrKm2vNemgR6p393TwKcBlIGvIWReUp3hWqZ0Fm-2FOD6bhxQ9qX2f64TCLqnkLxC2H-2BkJ9POUkyJZvKcr4Hcdfq9xG2ERAvjlXQFxfEtFqhzDC6J5mOJsm-2FxiMUv-2BbGoc6MyBGoBlly4sX19p-2B-2BGsZTPn51XOkZtliI27XHfqLRIrXZBGukmbiqQLDKKC9rTiZtgTpRZQnb67w9HqmL4h3lJ3hUcwbJRv5akZkkJEoauZtIUApXDvawXjkct8PMEMgSvAMLJbKWO8GHBRzYwmqzEjWw7llqnASoyHdNv-2BwarTy1bc9yi-2FfDN0l7Ct7XFaMMWtV0eTYyRRRo6Xt6MhZ37948dHUhyVdFW7KNUr5B6l1UNxNhRFG9S5f8Tt-2F-2F-2ByJw-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133566001527935396"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2428 chrome.exe
2428 chrome.exe
2112 chrome.exe
2112 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

2428 chrome.exe
2428 chrome.exe
2428 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2428 wrote to memory of 3420	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 3420	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2168	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 5092	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 5092	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe
PID 2428 wrote to memory of 2024	2428	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url5316.atl10n.com/ls/click?upn=u001.ZqQdlgq1feaOfcwOzw0JXbKavzjOSMVHgS3TqI6RTNnCgPfqWcHl7CNayL4K0-2BCvK4iHWYoKRGxzSBHrE6k6HkZIyDa5CfS8hujtREftCd-2F9g05jaCpD0Ol8-2BZGH42rRZ0lx_xtmRQbq41syJXnvJBBBkmH-2FsaZ1BYaveL75HeMcVtcrKm2vNemgR6p393TwKcBlIGvIWReUp3hWqZ0Fm-2FOD6bhxQ9qX2f64TCLqnkLxC2H-2BkJ9POUkyJZvKcr4Hcdfq9xG2ERAvjlXQFxfEtFqhzDC6J5mOJsm-2FxiMUv-2BbGoc6MyBGoBlly4sX19p-2B-2BGsZTPn51XOkZtliI27XHfqLRIrXZBGukmbiqQLDKKC9rTiZtgTpRZQnb67w9HqmL4h3lJ3hUcwbJRv5akZkkJEoauZtIUApXDvawXjkct8PMEMgSvAMLJbKWO8GHBRzYwmqzEjWw7llqnASoyHdNv-2BwarTy1bc9yi-2FfDN0l7Ct7XFaMMWtV0eTYyRRRo6Xt6MhZ37948dHUhyVdFW7KNUr5B6l1UNxNhRFG9S5f8Tt-2F-2F-2ByJw-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbb079758,0x7fffbb079768,0x7fffbb079778
2⤵
PID:3420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:2
2⤵
PID:2168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:8
2⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:8
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2804 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:1
2⤵
PID:4484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2812 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:1
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4940 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:1
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:8
2⤵
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:8
2⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2548 --field-trial-handle=1940,i,10487818205731936804,517247245699404802,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
0db729b6c334c6a7a891aec41e151aec

SHA1
7b2aa2829649d230e5cb3462bc620f1a1ab3b906

SHA256
e51bba3ba62855271813c96834c91dec215dff3ab15caf3e22d9ed23e5e87698

SHA512
414540e1ad6c82bc89ff5f0f115e642663f464cb768b1e8a60045b44353f06813222d1a452de5b9dac5f53ecff6dae37c7ac825ddaf6384d42ccd2fca1964422

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0896e454-4f77-4ee1-ba1a-30bb346331f6.tmp
Filesize
1KB

MD5
226c2d6a0dedb0a63f373a77f6e1f027

SHA1
aefdbaf49f88a75ed00df6df802beb53428d1cb9

SHA256
5b69a549cb1c178cff43839cb70f03882122ad33bb94be874bd0e319e45e6291

SHA512
c692ce4491e09fa2b2ed556d87f79d28225c1d2eee66ff2e04356c21aa88fd386954eadd29d9185983c5d6b87540674f16b7eaf4c2efb80f4b522dde67dfd841

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
707B

MD5
a0c5de785fee08761d326de15a6ce295

SHA1
428dad8c714e9acaa9ef6fffff85ee57b5116ec2

SHA256
4027f3007466babe764f8189a7df5874c5edc1fd3cbc5d1ac55f6fc326345c35

SHA512
1e404a37f758ae3c31d1aba90f77d051909029d425d021212fedbe6f9ecc7af2f43f1c16736d4939be264f992cea3e5c15c5a0c9b2562a2e2d55c1b3619bbb73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
5af72020d9791d103e26802d736bf162

SHA1
57cd91fd76bb7e4545a868e65165e9233316f2a5

SHA256
15b7c425cc85d4c8f1f3f28e0762b8710cf049a7b6680c952a9db17c9beec95f

SHA512
21d80c660cfb179e670d23d3f098d96ec2df2b05754cfbd758e297b82e6f098f3273299cfc4d3171d1c25f9bcda82c47d693cd258b7e24da9bd6130e01601053

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
114KB

MD5
81d8392a68bb7cd589532b815e18d588

SHA1
9a1f5a0ade7f6b48ed66e0540f03063650e4e630

SHA256
38450847e3aa6d47f1867ce6f6064b4d66f35fa51a95839a0d13bda76d5d886c

SHA512
7b3974f882dc0aa5450625df3fc7b22b779d6faf4da552ceffd1ddb2d004d8342d6e539dfd501d1ead968d6a92f4d36a8d9953bcc9eae72f583dbca94b94c0d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_2428_JNMKTAMMPHGZXUFB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads