hxxps://streamz[.]b-cdn[.]net/K1[.]zip

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://streamz.b-cdn.net/K1.zip

Score

3^/10

Malware Config

Signatures

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4632	4328	WerFault.exe	NvStereoUtilityOGL_[1MB]_[1].exe
3876	4328	WerFault.exe	NvStereoUtilityOGL_[1MB]_[1].exe
2768	4820	WerFault.exe	NvStereoUtilityOGL_[1MB]_[1].exe
4296	4820	WerFault.exe	NvStereoUtilityOGL_[1MB]_[1].exe
4972	396	WerFault.exe	NvStereoUtilityOGL_[1MB]_[1].exe
3800	396	WerFault.exe	NvStereoUtilityOGL_[1MB]_[1].exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608949190110614"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

5040 chrome.exe
5040 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

5040 chrome.exe
5040 chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 5040 wrote to memory of 3288	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3288	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 3944	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1252	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1252	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2844	5040	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://streamz.b-cdn.net/K1.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0372ab58,0x7ffc0372ab68,0x7ffc0372ab78
2⤵
PID:3288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:2
2⤵
PID:3944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:8
2⤵
PID:1252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:8
2⤵
PID:2844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:1
2⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:1
2⤵
PID:4964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:8
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:8
2⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:8
2⤵
PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1884,i,7906635238189205728,13762132807750749423,131072 /prefetch:8
2⤵
PID:1312

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\Temp1_K1.zip\x64\HDHelper_[0MB]_[1].exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_K1.zip\x64\HDHelper_[0MB]_[1].exe"
1⤵
PID:2344

C:\Users\Admin\Downloads\K1\x64\NvStereoUtilityOGL_[1MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\NvStereoUtilityOGL_[1MB]_[1].exe"
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 552
2⤵
- Program crash
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 508
2⤵
- Program crash
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4328 -ip 4328
1⤵
PID:1088

C:\Users\Admin\Downloads\K1\x64\NvStereoUtilityOGL_[1MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\NvStereoUtilityOGL_[1MB]_[1].exe"
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 512
2⤵
- Program crash
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 512
2⤵
- Program crash
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4820 -ip 4820
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4820 -ip 4820
1⤵
PID:4344

C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe"
1⤵
PID:4316

C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe"
1⤵
PID:4788

C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe"
1⤵
PID:2424

C:\Users\Admin\Downloads\K1\x64\NvStereoUtilityOGL_[1MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\NvStereoUtilityOGL_[1MB]_[1].exe"
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 516
2⤵
- Program crash
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 556
2⤵
- Program crash
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 396 -ip 396
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 396 -ip 396
1⤵
PID:1768

C:\Users\Admin\Downloads\K1\x64\HDHelper_[0MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\HDHelper_[0MB]_[1].exe"
1⤵
PID:3280

C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe
"C:\Users\Admin\Downloads\K1\x64\VSLauncher_[0MB]_[1].exe"
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7a3b3252d0bef3ce726494dee91a4444

SHA1
e4348feb36c18438ea82172521b39349d5936343

SHA256
0d757bf97d8fad88471d447b3fed718c8b46fd0de5b652e4b206de0f4cf090fc

SHA512
4761e289261056f0bac808dd8f716caa3ef9c9bd2e960edb1d695c443c7109c4635f068ff3b9aefd7dee8c822e400fddfca6c84ecbfb23ec8e47c8f9e18688ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5c9987f63198f03531ad25d39d9f500d

SHA1
689922a51371326c69dbad10d7c7a77475898ee2

SHA256
f1426c1d61525cd35c105ad07fbec467a4c47648a0022cd2a634da70ad3dfb3f

SHA512
ca347fd8cfc667f3ff7c7496e080ccf8177948b99c1cbaf4aac2ce03269630a0e4b7fbede97b13c313a7cebde9eb351eef188a58c7b81173ba5f4dc102eaa70f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
3fa2c751d58f94eb733c36afe73bbd7f

SHA1
c5e1ce17d850e0ab83eda00ef90f7cea99ed03e6

SHA256
b7596bd6e4ba2261f0ebc286ff63a2f73f5b343a1163816fc8ae3e6ba65b9a83

SHA512
18cdef0adc5882ba7433ab3018d09a5f5794b0eb45121174f3cdfdc445a5b6383cb37e150373db1231526cb5d706ec6eb334e9fb204d229a37eb66d2b30e30f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
b47fe9fb76cebc2373ba80a48ea39ae6

SHA1
18a842c43f1c9be34f0b61919f8aaaae37705b98

SHA256
bcc878fa36fc6c5bbd7154d47123e8cfc2d68d5537136601bc09cc31eb69d2c5

SHA512
c3ff8c990c420a066c0273fabb87ce87dde42a581e3dc66346390949c924b0eabcf8d5236789f6dcf23c94b5e4415fe30cef7b3bf4306d0e88377d554b5be44a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57a410.TMP

Filesize
94KB

MD5
1fd596ae2448f38e9033f14658e87c57

SHA1
207973d6c4a65777651cb28f42d58bd58fade934

SHA256
3f3ca93f65411d1e3b7f8ac880ea5440fa7e3e162d20f6c69c243a709c8847de

SHA512
459292327d50ae898e82097930d1732df6a045ee6fef0344e27c76b8d48c4410d6bcec390abc456713dba10fbdbe5873cce41af18de03ed6a5fc2b0af19a3d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDHelper.log

Filesize
2KB

MD5
ee70473be461b0c2ab329d90795a497d

SHA1
e62ac9a602980637395f96c4d523614f6fbd8c78

SHA256
6d35f171aa1016a9e1f52511c71545d37ae1a8c3d380e4cd1793b3e4a88d8c25

SHA512
8913204fe0e79ef366bed3180057c16a79b2effd11b0eca3d7d750c8282dbe9b526e967bf53ddd73c0f4a4fa55671569a70b3c34dd4535e4362108d665935c7d

Download Submit
C:\Users\Admin\Downloads\K1.zip

Filesize
4.0MB

MD5
272fcce5b2791b33553aeac4eb6af8b1

SHA1
c09d69c8ab975b8cf4923bf59522d206bc21153a

SHA256
64dbff7f33110db871db696d559208172b15fc51596bb952e2a0392b65faca49

SHA512
e6919556bb086b7daeeb60c7b1081abd3afb93bd4fbb545ec02fba4cbf98cf759dbbb74797809431e092c8905054748157c3cd1586c9796c3370719b83dd849b

Download Submit
\??\pipe\crashpad_5040_HJSKQEOAZTRMFDNA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit