1d9d9fa887c5b9e5b6c6aebca3a3cd601ef17dd9e97ae2b95cdbad0c3963f66b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cantdeleteme.py
Size

305KB
MD5

230a6f05ac8001a67cbf5172a025cd73
SHA1

834aff2b40d67395dfe53ceaee485d3f4d7b43d8
SHA256

1d9d9fa887c5b9e5b6c6aebca3a3cd601ef17dd9e97ae2b95cdbad0c3963f66b
SHA512

82746706fcdcd280e4248130be3c7a6ec17c429e9f837df386a4f98fe5cd0cc39eb2465602dda11596e59897f2a4dafa2a19678eb78f1870306fd0a295cb5069
SSDEEP

6144:sGKDDjq6qOot3n5fdVVnFwMJZEPKZ1NijnMgNCdnJyvLpw8:sGKDDeDOS5fn7eMLdne

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639903533696973"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
536	chrome.exe
536	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4648	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2388	4196	chrome.exe	88
PID 4196 wrote to memory of 2388	4196	chrome.exe	88
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3764	4196	chrome.exe	89
PID 4196 wrote to memory of 3320	4196	chrome.exe	90
PID 4196 wrote to memory of 3320	4196	chrome.exe	90
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91
PID 4196 wrote to memory of 408	4196	chrome.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cantdeleteme.py
1⤵
- Modifies registry class
PID:1960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe44f4ab58,0x7ffe44f4ab68,0x7ffe44f4ab78
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3524 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4972 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5096 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4064 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4684 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4808 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3040 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3088 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1904,i,1185401259929001412,5703311268661568848,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2be5f7ff6d9e1eaf0ad3b8ca0562eb95

SHA1
62818702e3a69adedfeff3be3bb2dc6b5d4e98c7

SHA256
991eadc0b02eb381bf8b2118c378872d9c23aa9c86675c6b95479e3bc9c0aa60

SHA512
e9d40f20994cc0c95f29c394d7a50c2bb8d3c4b722a06185b32d097f1eefd5b20bff6bbc9c348551579a15ff4451cc0bee74005d575c5147e53b33fad65c483e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
163a74ac6737883e3730c17e3e65cf66

SHA1
fc9fb65fd105124d199038caabc0099c67211e57

SHA256
4636c2cbe3187cf51e88b01e0ae6ab760e63fdc1c2e5b6e33d7ea590f2bd7ff4

SHA512
2a3d57cfe6999afc882d5ae38e2688d6e5d32e777d47b0591638f49aacc7ad781554ed764b1c1b13175be04776f2233570d92935e7886cc1e5d683f574c6c737

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
cc303086b1ceaaf64fc30658d6becbfc

SHA1
b6901587e0620a984be3393a9750e72ad6e1878d

SHA256
8d144ba8cb36f71ad00177edc7d910ead51c4e7017c4876842eb60b98651beff

SHA512
c5bef2dea218ba1a611e4216a0fb29ae173a5d5f4143ac4a6b0e95235e6e8b43e2be3d02693ee1f50a740f84685ba6ceec069ce0b1f88b34d44110350cd67dd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
91KB

MD5
a8bfeff7b88c1b01d70fb62604187c45

SHA1
0d836f9c089f6adeb4878541d7c28d836b78a757

SHA256
91fdace4823d722f14fd7e1bf5002b0d86401f66d8e0a15b100d088ccb16d736

SHA512
e24968fcb9b1bcddc20c1b10e3ef252f26162952b12471fcf4f062f08d76d6fecb41d088e7d826dbe182f47b4782bcdc38b0932cc0a7f61429271c5e11291614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5836bb.TMP

Filesize
88KB

MD5
14b9083bab6b4d103d8b11c7d3c82727

SHA1
156b20df9bad299fc91f3430ef0a596d8fd019e1

SHA256
27a5bc4d848fe8752d1cb985a6903fc553ef0233ea005c7bee2d275ccf0f5f98

SHA512
0188d2419ca70ec1ac3972872208bf4aafd7a5e13d1958355a5d67eb9d59c1e04ba0c83f44c90f56ccf2cf5467caf439323e427abf82da0aacb75c227bfe0998

Download Submit