hxxps://drive[.]google[.]com/file/d/1FVZP-1_rDq-BUHqkIve20KtqNg_7g25k/view

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1FVZP-1_rDq-BUHqkIve20KtqNg_7g25k/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com
6 drive.google.com
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

flow	ioc
3	drive.google.com
5	drive.google.com
6	drive.google.com

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675297140516022"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exe

pid process

1696 chrome.exe
1696 chrome.exe
916 chrome.exe
916 chrome.exe
916 chrome.exe
916 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

1696 chrome.exe
1696 chrome.exe
1696 chrome.exe
1696 chrome.exe
1696 chrome.exe
1696 chrome.exe
1696 chrome.exe
1696 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

Processes:

chrome.exe

pid	process
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1696 wrote to memory of 2812	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2812	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 2556	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 3572	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 3572	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe
PID 1696 wrote to memory of 1976	1696	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1FVZP-1_rDq-BUHqkIve20KtqNg_7g25k/view
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe8dfecc40,0x7ffe8dfecc4c,0x7ffe8dfecc58
2⤵
PID:2812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1884 /prefetch:2
2⤵
PID:2556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2376 /prefetch:8
2⤵
PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3124 /prefetch:1
2⤵
PID:4064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4316,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4388 /prefetch:1
2⤵
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4768 /prefetch:8
2⤵
PID:1376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4620,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:3712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4384,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:2528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5436,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5400 /prefetch:2
2⤵
PID:4292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5912,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:3796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4908,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4912 /prefetch:8
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5404,i,10556265259377418701,4283437083777199202,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:836

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
312B

MD5
668e1f0479507bf3e18d5b77a2baf11f

SHA1
3d60de83c50deb004f431dd8c60a8ab617d41ce9

SHA256
2c87dac49780010b1febf039b430194af714046fad425e4e58d0fd6ff42f9cd7

SHA512
18a886517aeeea671b7b21063848ee6a630cd515d5c093a070ff8579d1ae038100ef5187ed8316efb1f717fa3164aa28e934871fc2c51aa03a019f0df2c8a154

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
84e7159b8f2c4ec251ee44be9ca5b2d8

SHA1
317f4126635d5cba66b0f63a877686307627a350

SHA256
574859e5b68dc933e1a7ba5a5ad26e8e56e0c7b84b343d806c407a569c61325d

SHA512
bcbfaa01d774d6c15d69469c733797fb55456acdca132f26e497250182a1676e62332b61acfc131d98fec1a871f205bbd199af84582c519650ee3fe4816f639a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
45d7214ba1309ed3d5a94cfec63b11e4

SHA1
8370caf058eebdad64460cabcb46db449d232257

SHA256
fe92e61983ce1d4c2aa3264c43c6f91ee38442664c0bd54a9502ff9ab022954c

SHA512
0f01524a97ee545f0a7a0979234892427211fc84de4d1594339e684f44b79803713e21245db5f428392ff5e332f4d671c62ea7b8c28740dc75e1f1b18b2e9071

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
d781df503bed73de8e8206e4b292dc34

SHA1
58c0b140020aa2a1a9e13d0b8ed13f0cf5fa1b6e

SHA256
09ea4b172718d451c6a9a7edad349d9b7e9c72544b9b7c895e83bf847d3a27f4

SHA512
285406059f8fe5a6e080094c0f0306104e5670304f83a4f77762ec7e3bcb97b375ce01b9b190e55a5e8862662789425df2e18ada92790aa643379ed61eca11ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
859B

MD5
8bf05832e7e27983219679cd8988a443

SHA1
9494a1ffee190d16054782048827dad00e25bc99

SHA256
4ef19e46feaae8c0b2deb413acce9faca0b7d95574a3e4b10160926b02b77be9

SHA512
cc169aa59154724c967b16d9ed8c1fe5131e2afac49af2a465266b61c2d1a82c3775d0e4a42d62f64618ead2a82291bed702b8d2a1e27b208e4aed3bf11a4ead

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
375e80ef35388c63d6ba2ee95d3ab112

SHA1
33b72d4cacdf5e9eaa696efa6af938d44427d63b

SHA256
ea0225f67714ab17eb7dd8c184307cac2ad74bd79aef5cda63c6031f57e2b7a6

SHA512
9a1203a86033b30f026a69592110eabfd17da87e4b8a8ff0ba382f23ffe5795541b9a66c022700bcffbf1c547fa6bd7b4bfe8faf060d21387b3700e13979bac3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
59b2c632714057b5eea20f6939201136

SHA1
7af1f2eb602ecce2ab8833bd6da69b4241e56a8e

SHA256
f0be210dbbccf193c5f8cf8cbd6842a9d13a1cdd08c8a14a09d38030a21ed630

SHA512
46941fcbf969e27a930410bb94a8a17d8c37464e7352891ce8556cac288168a5be7311e035075e65bebe06bca37ce5b907a267c599b329dc1815f44a5440ba57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
39e5c62fd9304a80f020b17e7e62be3a

SHA1
da880619c7db21a0ba51a7a3cd4b9f446c7e2ff5

SHA256
5818ba3a52c44d05e58e8b41977a5cb8fd93e5bb0a642efa82346dd1acb1fbb7

SHA512
22ab80bcc5db8774e1c66f4e81e765290592098556cd2b5b9e60f4c358a6cc2677c49b831acce1826c48483b6d6e96b185483ee924d80d515474628c5301e779

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
49dca912a9948d3a6736d717711e4d52

SHA1
1cb77516844759a47117cc11605c8355ee53998b

SHA256
a42b1af289b0ef2361c4324aebe4aae8ddcc6f73593579331565bfa8535596f0

SHA512
2356817b067e681c5b5b28fb8b7c0e1e620cd2fc13f6f9621fd69128c148c9f4e4b9d0fd2de98ae90d8c0a66a337b990d00367a4842fe45c16cfb2163e7cf771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
1f41445cfda6b54ea43d3f4cdd337fe8

SHA1
0da71adf812cc34c9c17b2819a014cb61c4de076

SHA256
32d3717b4b20c5a8638c18c09660deb1c812d7316cc94d94e43a3ce37f25ea3f

SHA512
ecd5577e50bc11b419fd299e88158c9ed23244987ced23cfe2c41b4c79c1e173d23a437ec4af5080e9cf91604896e83fa1c7b2364aa5db394d99d6970b265dc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
f62c62ec0ec338f4fc141ce940ec6edf

SHA1
9d957af4ea6a8e870cd2e662b8d12e0ce6ab3316

SHA256
254bfec3723aa0a2e8ef5c905b05e92f6b4b8fd9c5616d13cdd6412a32df6ddf

SHA512
c622e93dc31360fd5d2697fdd8d8388a1e33cd4f25ea0cf1427d4381328c322ebe853b0a67f5cf3501871ba19e0e6ccd5ab27805c35426dd929951b2f62b6cd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
0e7efb3384794b0b8692c5646782b1b5

SHA1
7de2a259206a82e47114c9f66d51835860543ec8

SHA256
de5c4f053c26d7ab04051d580f2caa251c4034f9b9ce643f070f30ac05640b34

SHA512
ad1498ab10a166cded9a81dd93a0c93c1a73132cb78ca14e9f344f366802db73772a8215976b80643c62983988608aa1d91abeeb6e2651ee02ee266c511721e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
17a39072ddc41480798b69e6e76dd19c

SHA1
7ba06a96f56d4f4f24191bdf025c5ddd76d27adc

SHA256
2b7324c55c967fd0fab74df0b8762fdc287aae0eeaeca9b492d6e5729b66cabd

SHA512
ba75a818321a1b385d676314d337e019c20a98a6b4b8ce2fc671614605719f545108bc74482df9f0b63be046fab133ca8812a3726b3b2f32fe38a775b8a6b779

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
16dc55daab5521a8d230196d019a22ce

SHA1
45cda6e1e0fab9b5b4dbe14c64513fdf0012e17e

SHA256
da284785441f6f0786d439d28372c211c2d5c7e0a43bc56674157d9270e16e68

SHA512
09d5698c32d6b1e48af81bc651ebf739ce6955a0e84143ac3236624ed3e82b3ce9750dace08b8a0f0a188ba70d57150127abed020403cca42b764179727d6154

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
c068c49a6175b88b5d8fe250bb5fac1e

SHA1
ba4239576ac749a3658857ad6a5d49327abed561

SHA256
07a13bc15b712e0fbb3a58af8f7903d82934a659204cd4eed6199f456eca2dd6

SHA512
ce53366284e577dff1b21ec4f7a44851273286fef142eaf052801c3087aaea022aa8df2c3c6b761712bb75c67ff12616dda970fcb4c147beea7b97710cc3195c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
288ee412916663778a452e0aee60ec9c

SHA1
0ac7749b5f308bd9cb9850a82a426de98d96ff45

SHA256
5568b68f840a71f6e232aa3568b5d3188919ff4d90ce1bf7229bae768a941552

SHA512
45d2dde29c06f396f23b69bf7b3e6b691df7e926224466a476c4d63412ec83ab90b743dc3392b535c4407f7f0996fa8ce5b34382faf74a3c7aeeab0a216b6c7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
7096b2a3d7f11783f28da8250a348823

SHA1
c58e269100fec75cc31e93eb68f32f774d68adf0

SHA256
8a98def3e9ccbd903e507aa7e0c5378fc25c486f5a7d69b32a927b9031a6141e

SHA512
c49be7999e85c867e76770beb205513a9554b127338df3e66e00bfc2d81c70c7028d5af77dfb4ac800df9c630d719482571666db1dc25eaca2aaa46bc439f549

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
5a2af80ccd4ec76e6bd7c7c3375a8623

SHA1
58576654ba72013c5180cae49fcbda7f982ebd6c

SHA256
3f41be902e2d1497fd05ba039e43bd02ea255931d879eeb8e6eeec5e4e128831

SHA512
0c6a8f6209b1a6f7c0cda28009b4b235e8a791a35946335ab2fd26ac88391c1ef809d7b056a4e4d54d995cd0963db89ae28c0f35ffecd8990e4c454a13744cff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
4625302e3ad1e40b65dbbe665a343b0b

SHA1
ad9e661a86059460599a782950b9f34034e3051f

SHA256
9885df67001965bd450185cfe3e7c37bb8e189ac8ec9cd2a5627a2eeea86ff7b

SHA512
a433152f08d2ac5d4a871fcd4d9019d22c7f72cdb6992e8cf0dd88b5a8bf986ea2da9fc0e9ac48352a95def0a784adc0a3752ed5703902cdc927c7c94259f80a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
e7f94cfa036fed8902685554b25f1882

SHA1
b68f7ed2f013f13a36d10485f0009d2b0dbe7a40

SHA256
80975866b7d6b4c5da5593db542040021d978b2440fdd0663a58ba539a3ffc0b

SHA512
3a39f05a791eb7083a3345c18f7c2a94138cd692d2a4bce8ed7d1a797b66a8486961945b4288b68e2d4e14458c4187e498b814c6d09dffe1044b1fd21f756b77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
527cf680fa71a92d3b1816a9052bcc27

SHA1
be3029193a37ce2bf9d32df49e7e4c40292f413a

SHA256
74422b0f3e04c04aa9b04fc6703a2c407f0e7a8ced40446246a9fff4d77302c8

SHA512
d93c6b92629e61701f8c3b3a9c93955d0bfc5120ad6442a2405721b20059f1bd451e07bb27f29dde16fa6c5404579f966a668caea8bcca891830a04114b28c72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
aad48436c4c8e40f198b955bc186589f

SHA1
4568517494804a042eb69752242ef39410e58c6f

SHA256
43e05bcbd0a5972aa3b107203cfdf5f21529315cc409ee2f806d7fed6e9a6d22

SHA512
bdc3256fed10e223148d2faf9098d5d17c09f1e009f0d5fa035a75d642c61e74afa3e80c4d0c7e77a12f077aa73e6ac926b4ec66052b740e9f78d810ae1ceed5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Rules\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
99KB

MD5
85951e755b3ee1692678219a2c962fad

SHA1
72536c1817acfdb6c22ad3b2f97cb6c64b1b59b1

SHA256
8315df9fc10f54d1080ec48ad3dc97b24682344d4ca1d909088d01ce02fd7ab7

SHA512
302523914e40e46ef3911a9e0f89963f54aea539daf3239bb82ffc09b00abd436903926c29e136baab2ad803486c49365226877e8f0a70d4480a2b7fe27a2f55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
99KB

MD5
aede50f6546b35194acf8b029d37b2b9

SHA1
4cc6495f247b22a43f58bc2dd773acf97cfdd37f

SHA256
e3e91c257f38a30341db71f1c879174f217444e6c7b109ce6e24de5285c69190

SHA512
66d3b1f72e1e8b415f91fff807a76de6c643f66041d29975b154794c3e7a1c129fbd03c39589a0960dc04c3b3a6e6921775faa35b2f3fd17aee8cf6bc1bacf0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
99KB

MD5
6fe427334f2439e4dc7057e459a506b0

SHA1
650c3af46e4a1538626b1f61f5fd678f01e2c061

SHA256
8c307702ff44c3e90c649b2ccbf8f73cb2e15b372980c1ae4ae1c57d414a99d4

SHA512
71e694f6c678a50283fb11e1ae3960beb74ced93d188aaef4c9c8a4a5e7b1bf5903685e42c1d0cb4746404d9e0a835303b0bef7b081cdcf33d2f9aa5f72c7671

Download Submit
\??\pipe\crashpad_1696_JEQOIDWCFHTVAKRZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit