7a8f13709abce6b8592c6d049119edf50d3099265a6745518c098590a98d7516

Analysis

max time kernel
1778s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240412-es
resource tags

arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
17/04/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tor.png
Size

823KB
MD5

0d666d466a77726efbacd1fff74558fb
SHA1

1b2db7382f16f31be59ad9e3e43796a8c2175210
SHA256

7a8f13709abce6b8592c6d049119edf50d3099265a6745518c098590a98d7516
SHA512

c73cfa08bd6c0442f5d0414afc9d7cd61fe3afe8b25aa4fc4ca7e5b6e8ade98f119636e5ca59b9af1063bb4bb46c53996221dc2d5370ad79790f6fa89f83a2d9
SSDEEP

24576:CUAwtYZPkkyQZbbOIR+xHvh2wPsiaCeeR39:CUAw5kyQZbbOOwHvhbkiaxUN

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133578214341361136"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 404	1280	chrome.exe	93
PID 1280 wrote to memory of 404	1280	chrome.exe	93
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 1056	1280	chrome.exe	94
PID 1280 wrote to memory of 2400	1280	chrome.exe	95
PID 1280 wrote to memory of 2400	1280	chrome.exe	95
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96
PID 1280 wrote to memory of 2940	1280	chrome.exe	96

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tor.png
1⤵
PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdbe9cab58,0x7ffdbe9cab68,0x7ffdbe9cab78
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2312 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4520 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1264
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x230,0x258,0x25c,0x234,0x260,0x7ff702fdae48,0x7ff702fdae58,0x7ff702fdae68
    3⤵
    PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4652 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5084 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5184 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5324 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2308 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5160 --field-trial-handle=1912,i,11481622176720015886,5610294204076429781,131072 /prefetch:8
  2⤵
  PID:1648

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
0a6d915104e23422aee5bab743a096a4

SHA1
6eecf35bde9e8af9b0784ebe213525d9e6887b85

SHA256
3a83256433f36c3a611c62847bc262d664405457eb7bc9c3614418aedbb922e7

SHA512
0179d73adda244092d1eda80aaa6b96a05653b47401b6239f598553bec9bd2bd821a8b92d9ffdc19610be8532faa03570fe034027c8b4ce99b446556e38421da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d191b4ef92916c172779b6a6e2cc3cf9

SHA1
bc5e710771b84e3d5d4ae20170cadf7ca92a183a

SHA256
cf3a121ab73aa7f93cce2799a62b6f97fef82d5c3685548c720fb0d925aad55a

SHA512
23e4fb1a4cc060f33e9d7ab7e56314e5a8a2fd96351471a1264b258ae884ff2babec93d7d39acf7a868e2b460bd3ffc5382e82681c4cf4ce2e7fe2a2924a3b5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
15589f3e6de29ae7c4d45473725bf547

SHA1
aeffcd528b5cf432f11f588509f93b4447b0d84e

SHA256
e876f0cdce35c7cb7626cc377b6dcb950cf6907e42b03c018da3127be47fbb51

SHA512
7290bcfc824df0d7f0832f318af591decc5371e3ff5f1e447c6f36373c677bce603b3846e892c6aa4443ff4b0f4c81ae7d1d96f2f983ad11427a3526098b41a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
77e667b9fb41ea3dfd2e65c09ddbab2a

SHA1
f4fb4863866f3090de0995b6032ae94d0c365a28

SHA256
6080c31cac058503243d0d354ecb409fb4ed491c8c1b3c44daa8b6d2ce8089ff

SHA512
a70f69bdc15ede0f4c8c4ad5c703685c9899f66c2896c007d4950b29dcbdf962c3c982174a7324724ac2b16cd92197ef652c911758cad19f1fa22968cf455c70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
635a3d6d7ddbdead491231d4c92cc1bb

SHA1
39b23b47dd6ec8f85303980db895b7bfec85b183

SHA256
19df3dbfb790b146a2cb34dc6db1f3ac34a41d2b67b23a64d82acd3fd1276d46

SHA512
00c04d204eb5fa30e97e73e058c4344cab019caec0c49665d48e2b61919637e438174e24d57996921e6138b57e9a3c86b93a5f397f9de66047cc3feb17840292

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c08acd4a06be6438fcb1e264614a2f48

SHA1
e5f71872b3dabfade80177f1b35ee983b3d6744b

SHA256
252be2c0b478ab609e326dd3b5eec57fe014758e3c79b06386c5dfaf5be5a4fe

SHA512
34061e9836a86538a593763594e52d414e60370e6dc7fd9590f2f6e2362dc2e650969c85aed8edd26bf8c61ea5d2f02e1b34c1d6db3f955840848ac98ff17971

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
fa351a2634c2408c6dd98ecb41130ab6

SHA1
bf5f48c3e3989a2e3bc1de7c0969311d626c8117

SHA256
917d1d04330bd571b2e3347d048d0ff9689fc9df9fe09fc3da9cf0cb5259ae35

SHA512
05d862d0438575e26a4085de20333379d1679f536cc15bfc976e00168ec39f72578990471d9ada8b137a5136440cba29c797c1a48145d1c2d11663600744e80e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
5505ec45721b195d6390632a7c39ac86

SHA1
b56fed85e19d984c7308daef38d607cc144ff2ff

SHA256
de7a073186d5d81ee502ff7ea4a5f50ad7e07b35b70bd8d110e3a7d0c87af204

SHA512
ba924c3b12197aa67cd10ad73d31b465f90e71a24ff9b8fe6bd08751ca82b7947e9bdba1dac73b9102e7a6fa8baeb7e52628359c791f717f9981a26ef5dfa5a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
251KB

MD5
4a51e8f53f4323bba7c4a305826220c1

SHA1
e8569fb5aeefe09716d9a7744f1d937b04802f2d

SHA256
fe424f73f30114e9ca33fb35502febe74f4fa0e7cd2b735ff883ab78774cdea4

SHA512
4694148afe09d995ff288ddf5651a05f6cb95bb59e2d21005ffa503db082a283ad6ad4bcd607dc052d7e44a85e5327751bb7a62bed69f7073063871fb937c0b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
251KB

MD5
766fdba0a9729d9ee7834142548038d4

SHA1
43ab8fd127ada46d6b616c5be374f4d16d428673

SHA256
a5784bc7bf1c36e0ec59e0717628f4ca8d4e5edb1ad1bca3155c310ce2cbd7b4

SHA512
bcdae159de19794590366d4f5fa340532c263eb85ae5b59c0b6ec8c7d28638f67197322e1b7aae91e6e5fec5a35297ecdba7c7942d1014b194e4dee7e77e6cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
251KB

MD5
7072d0de5fabf9c44628334e0ae37bab

SHA1
446b36cd91bceb8aa0c67df94a9cf4b53bb55b28

SHA256
e275c1e3dc9ea68468d16b33b5c2e8174ae1e5f0a8d26556c837efa9100855cf

SHA512
30902698c0c6ed3116b353d10e21df0f16bd4f76c8f29759b4166bb554461229dc54e01db13c0427018e5f9fa1087b51cf1ded23d9b01f259eb8e16194eab280

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
96KB

MD5
0dc990a585b2737049cdcda4b7b63253

SHA1
02b0585443c00ab302ca3fe5aae2f7b04aa4dccd

SHA256
c40e72491d5eaaa57ba917fee881f74c80fd9a46385e22be57ebcdf37f54cac8

SHA512
b69a0a6fa122ce11e43e21f34680703cbd6be146b9131952c26cf3c0266893d49e14e6b4c76f85feeeb9502f23576140d852127e2d2da0bae83a64845869b007

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5d3664.TMP

Filesize
90KB

MD5
819dcb7be06228e1d287fc8f4d16b564

SHA1
5b654c12a0351863783dc9ad0a42159e560c82ac

SHA256
21bd400e4f40774ef66edda15a57b5c026dd25def428575591bc91c2f145d63f

SHA512
8c9d1c8f2edf09b0ebb588350c0a14ffe385ec27839888fc1ce1001557c6bc9a0b86940f0d10a0ac14ae8ee25206831bca8c74a7cbef6cb37a8ad5c3b66e77ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
8e6d667ffe21eb07ec9acf7ceb3a26ad

SHA1
8a905a7a93049f1d7e92f6975665dbf6f5aafb19

SHA256
df3fc823f3d1fbe86b005d690719fde09b50f2f1b2fa8f9542892b45de46f303

SHA512
07223fa5a87cc1aa4c04f55f37293a7acb02cab407c8f366fa763ac3b66b91241700be74cd6224afc976dc0a6e42eadb139e1fdd172c9a56a41fa9f8254eddfb

Download Submit
C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.0.14.exe

Filesize
99.7MB

MD5
756994cbc174b3e69dcb4377e8a7b3c2

SHA1
2fb14aceba0c8df3478aaf8c039d76c6abe3ac36

SHA256
8738a94ae5290d577f3aa700e918239a4bcdbe91d41d201434dc93620617997b

SHA512
a870822e4268b04f1fa8b937e1b1be29286df4492173e2fe5f21d4bff1aa69ba8f8e50670a40b5a372ff2bf23a1881ae9417fc36c20c03bcb9166afd64c22a17

Download Submit