hxxp://Invoke-WebRequest -Uri "hxxps://github[.]com/xmrig/xmrig/releases/download/v6[.]21[.]3/xmrig-6[.]21[.]3-msvc-win64[.]zip" -OutFile "xmrig[.]zip" Expand-Archive xmrig[.]zip [.]\xmrig\xmrig-6[.]21[.]3\xmrig[.]exe -o xmrpool[.]eu[:]3333 -u 4BCzRFseZPce3GUMsqGEHjeSgzzBhE3C72JdGdapz3kgdWpq4ri7NbNfTKCotSdAP2a6c6f4Qq3XHWRMJX1EYJnrDrSeJG3 --cpu-priority 4

Analysis

max time kernel
1859s
max time network
1820s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27/07/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://Invoke-WebRequest -Uri "https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip" -OutFile "xmrig.zip" Expand-Archive xmrig.zip .\xmrig\xmrig-6.21.3\xmrig.exe -o xmrpool.eu:3333 -u 4BCzRFseZPce3GUMsqGEHjeSgzzBhE3C72JdGdapz3kgdWpq4ri7NbNfTKCotSdAP2a6c6f4Qq3XHWRMJX1EYJnrDrSeJG3 --cpu-priority 4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133665162275125799"	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
1672	chrome.exe
1672	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4376	4896	chrome.exe	74
PID 4896 wrote to memory of 4376	4896	chrome.exe	74
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 4592	4896	chrome.exe	76
PID 4896 wrote to memory of 3232	4896	chrome.exe	77
PID 4896 wrote to memory of 3232	4896	chrome.exe	77
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78
PID 4896 wrote to memory of 5028	4896	chrome.exe	78

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Invoke-WebRequest -Uri "https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip" -OutFile "xmrig.zip" Expand-Archive xmrig.zip .\xmrig\xmrig-6.21.3\xmrig.exe -o xmrpool.eu:3333 -u 4BCzRFseZPce3GUMsqGEHjeSgzzBhE3C72JdGdapz3kgdWpq4ri7NbNfTKCotSdAP2a6c6f4Qq3XHWRMJX1EYJnrDrSeJG3 --cpu-priority 4
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb2c1f9758,0x7ffb2c1f9768,0x7ffb2c1f9778
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1824 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2656 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2664 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3880 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3136 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3112 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3976 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1696 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3224 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3904 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4700 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2052 --field-trial-handle=2292,i,13461891949944785810,1982363193715427961,131072 /prefetch:1
  2⤵
  PID:2948

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
677B

MD5
7d4acedc430d8f4e651a2a90e7d7bde8

SHA1
d242fb423100b4dbe553305613f7be2f664bde28

SHA256
89fd01b9e20a312d37d5ea95bf76224aa49d77ef9de5f81e53c18b51fac2f4cf

SHA512
868c14998cd50739a17f02dfd824836937c6e42be4dcb0975762dd6dec092220e09a906d3c419584f1bdbfc85ee9a1bdbb817c136a67b516ac76065cef12ddf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1467915cc797405748408d09872cd59a

SHA1
e064ae65662633e5ae46b2986097a315928bb3c2

SHA256
50fed36da1cf7744560b9eaa2a6365451df0e50509d174521678b887abb3507a

SHA512
a6c5a0faa2a6350bc3137f9c3dace5571b31526406924937e16ba2e2d7fc3f76b7ed31891fc6e7c348798b389205bfac77e28b6aadb0d5ec6d769f3a62f6f860

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e942d3e98e2c7eb06fa239c4d7753408

SHA1
14142c2b8786694531fc844faabbb32dd3521464

SHA256
48ac9eb503adac93c242ea8887f9a27249c0d8e7ced5f4d0e68a67e82d6b27c6

SHA512
e988c03e7b3b9b8d944cc569e5b70f50a5b7f0de435a1acf255f8bb0799a3eef960c8e5691a145b73f2eb5e91866f0b1293fa0afb9cd2fc29e1c76d053438c41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
457343a4e28271115d9f4c7ea1ef1e80

SHA1
b2cc7f81c1488f0b1fc450be3ee19ce118065161

SHA256
2aba5b204d45146ecca540e0ff2b1f55698b8791b17ac530aa08ef415e02035f

SHA512
fbcbd51acf4ad9c83952563fc750ed48acf0ff99e4aa4dc1ec52b57842bb95eb66791773c90371ac0e943f4d5503267677a2bb3572ec12a07ecb51348fed0fc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
161KB

MD5
3c64569e6ec6e89646d3b37e47f464c7

SHA1
5bf16a440573b43c4a5a56bb3013b9e61ac38a62

SHA256
6467ba8d6cbdc29573ffe5f9cef32a76003ddbb4a6fe0d02d9a62ae7cf3a42d9

SHA512
78902e636bb18c3847f97669d24650e88e287f73f28d42a446ee99e64d74567b3d8b398e3e24717e8dc05cbf2f1652c602e34804195b8297aa0c87b9333996c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
f53639cee200397850490449a7951793

SHA1
72ba8c8d29d80e0eda04d9f7ab7eddcc6c9d11f3

SHA256
0d4a3ba68ae859a205e4455636c373f17bc126ef1896a54fcb78f8af724d4bc7

SHA512
127d8d980c2e11855d75e962bddce8e413f1713272faa027673f2a4e5393209be09e8da8e8084fe06555db84a34e23ab48b4a91bd2755cdf239774849d476eb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
cca60ecedbca3a241d8626ccb9964e75

SHA1
fc82a447a65924f4bb0872a8169f3465a6759edf

SHA256
4034fb6bca6f568c863f612f4c43dec6d07e9eaad7a1bf85666c88b1fc93bf9e

SHA512
2fa793dcb866f4e3fcffd54f7d314cb81f418398262f105f2a0dd5d0ae543f3022f538fab60cb5903e968613fba1cf97d313498c006c0ebbb23a66330cbb2d59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit