4138d9cf60fdd58ad890c758ffcc249cedd8c4a2f4dedd0775ecbecbfaf6ce28

Analysis

user interaction
yes
max time kernel
600s
max time network
594s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ited6je.html
Size 33KB
Sample260501-eacgvsfz8q
SHA256 4138d9cf60fdd58ad890c758ffcc249cedd8c4a2f4dedd0775ecbecbfaf6ce28
MD5 d980afec2e1cbf44ca7385687301d0b2
SHA1 ef46b81ffc9e7299ed52c9e15cbfd38c301cb037
SHA512 ff295c4b2c07aa7753cbf52caf664ba3ba3fcb838285c7d24a4b7f3c41f755b09d8cd0eb70d37a32f4354f8bb96b4f450ce401d1934297d5c99be39f6238c0a7
SSDEEP 768:JAkLWL+h3qDG/JGJPa+WZMcR9+g54AHFDSnTVQ4/YU+v:JAkSLA38+GJy+WZM29+gKAHuVfC
TLSH
T184E2F980D708FC517242898E60EE1C252254F9B37606DBA8FF91DEB6FEA58C05427B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5468	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134220806811954150"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
4648	chrome.exe
4648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe
Token: SeShutdownPrivilege	2908	chrome.exe
Token: SeCreatePagefilePrivilege	2908	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe
2908	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3232	2908	chrome.exe	87
PID 2908 wrote to memory of 2268	2908	chrome.exe	88
PID 2908 wrote to memory of 2268	2908	chrome.exe	88
PID 2908 wrote to memory of 5468	2908	chrome.exe	89
PID 2908 wrote to memory of 2364	2908	chrome.exe	90
PID 2908 wrote to memory of 2364	2908	chrome.exe	90
PID 2908 wrote to memory of 5880	2908	chrome.exe	92
PID 2908 wrote to memory of 5880	2908	chrome.exe	92
PID 2908 wrote to memory of 1568	2908	chrome.exe	93
PID 2908 wrote to memory of 1568	2908	chrome.exe	93
PID 2908 wrote to memory of 972	2908	chrome.exe	94
PID 2908 wrote to memory of 972	2908	chrome.exe	94
PID 2908 wrote to memory of 5636	2908	chrome.exe	95
PID 2908 wrote to memory of 5284	2908	chrome.exe	106
PID 2908 wrote to memory of 1132	2908	chrome.exe	107
PID 2908 wrote to memory of 1116	2908	chrome.exe	108
PID 2908 wrote to memory of 5288	2908	chrome.exe	110
PID 2908 wrote to memory of 5288	2908	chrome.exe	110
PID 2908 wrote to memory of 1976	2908	chrome.exe	111
PID 2908 wrote to memory of 1976	2908	chrome.exe	111
PID 2908 wrote to memory of 4648	2908	chrome.exe	112
PID 2908 wrote to memory of 4696	2908	chrome.exe	113
PID 2908 wrote to memory of 4696	2908	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Ited6je.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa2176c728,0x7ffa2176c734,0x7ffa2176c740
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,14585250927983273722,8217300146078115593,262144 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,15556851496270688072,15943681597393661021,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,4365375908884397948,4200918355155221502,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,7308931518081328617,5186208070125549366,2097152 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,9357263031400586306,5706137892202262497,2097152 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,18175993319252152410,12496136721984095536,2097152 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,12714697957472665772,15410256869914142355,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,253690724776735180,4099549904372312479,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,6147303908361511926,6156073656413479437,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,5151291053842906020,9225466525117553305,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,10153174429064018315,521703316300962821,2097152 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5676,i,13831731271426411113,10149155367888658214,2097152 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=732,i,16229294360776493770,17707514124233541582,262144 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,13623109889327348509,9060123230590308389,524288 --field-trial-handle=2084,i,3361902523739845635,6668841007511453833,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e88d5c4edbbbe114252a931306e46ca7c53872e9de5409e882de7d6edac1ae28
MD5 9b5e9edc43ee5d1aa6b7e1e9e853f280
SHA1 d92ef872043d7463bd27403b73b97dd8c7207bdb
SHA512 6280aa61c9482ee07c2a6268793aa0f51ebf0bcd8b9212cd2526b7f590dbda95ef148d7dae5a0800ffe4d1e1eb9b35ae983eeb81c055c598063b1ecf8d06a6f6
TLSH
T12EE02BD6CA21EC3B14FD1B68B4444A45EA9403573B80495F3E3D820C8FB863A068685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 803351815b67971a45c56c9e1c648cf5c59fcb25e53007f3593775de0192c76e
MD5 eccd931a300f472dc3d20f8fe8e7b93b
SHA1 86aa63885b02e643311b486ab91788d8d1eca4bd
SHA512 6431996171c561741559ad51dfeded8a0947ec036d1a64813474f1ffc08fb45cfdee06c173c8d8e6391af6be0ea82250361f9a300ccb3bd53e4f8492f97414ef
TLSH
T1CE716CF7C3E4866DC91156F4AB157E1FCE6D0A14432C3C5688D4AF5B53E29B2D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5233104a37117664843a67ce841a0d39ec9fdef3c06e9ba6f69679da25e4375d
MD5 4379cf563f0cc775fcc9d30ff3326bf2
SHA1 b043e4290bcb3bbc64651628d9cce145c876fe17
SHA512 84135d0843f150b4b6168d84e1514d7a143f35cd26184aee7f487d85bd3e5c92c608f91a546203f74a575f8ae37a2f658053aac0701d5578a0d817be6a7e1b98
TLSH
T122719EF393E48A6DC51196F4EB256E2FCD6D0A14032C7C6689D4AF4B53F29B2D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 94636408a11f0225c4b71a8263fc520f856096bad71fca5054051d7c6e50645b
MD5 7db0df976e719305d43ffaa1546a5000
SHA1 9ffe266e98a382003305f0463f0269bca6c82fed
SHA512 f8d15f5e52e79725dbdcd5c728485f8507b4361945038dae9ed776c10b599de7e2dd18d152cca4e73c7344b62dd2c41925a8214f4aa2c363b0d40072b8054109
TLSH
T1A3717BF7C3E4866DC91156F4AB257E2BCE6D0A14032C3C5688D4AF4B53F29B2E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5158c3d11973fe00a82e0dca568be4447596e313c22820c757015c55a3c562d8
MD5 3129519c35043a587875fac2341b4e4a
SHA1 831a60ec9447af155c60684027afeaf8d6228884
SHA512 6ef1e6f528733e8e073a176b16df50ba912d9036a9d456956018d427e2f660afef1850715b3f1e9f15a1db3baba94c077740511b0fdb94bdffbbbc0efa1b921b
TLSH
T1C6618CF383E4866EC51156F4AB257E2FCE2D0A14031C3C5689D4AF4B53F29B2E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3738bb0e4138743bea2a8760f8d17792dea346d881fea8a049b3bc793313b5c3
MD5 c5d31a2d60297b416e304954dee00ae1
SHA1 68db2a2d53013a9af6cd35e23e88e925b041c717
SHA512 f4dbf1c182e96601a0e8f41e35fe079f202c9a12b305d07710b71fc3e49f28b17896f6005766666278ccdd5c9eb70611d519484f4b6b4b7b562cecb3c019f2a3
SSDEEP 192:IRQTNJ0kdwoRv7tYpQPRpShUz9CHsb+WNnm10w12KCTkwaN6aVyIsnAUgE:IRQTsYBhYwXCC4wA0k2KCT6saE
TLSH
T18D52C72EA910793B9CCBC229FD61BB67E7F5102135941E98EBFC8A2C15EB5CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6c40ba62bb1f2993b2b81388685aae0408078034b4c5d69dfeb68cab44f2098f
MD5 481a1c00f35e610ac128a477401511ab
SHA1 b8711327f165d0c357d2985a6e4dda9dccbe9671
SHA512 09840ed57618a76b0ee5396a21c736e6d57989b3549c8cfbc57fe555b108f54c32da1a71a0a8b1be1063f0c9b1156354fb68927199caf2e9424da1e310ea7376
SSDEEP 192:VORQTYJ0kdwoNv7tYpAPRp2hUz9CHsb+WNnpVPH12KCTkwaN8aVyIsnAUge:VORQTbYthYUXeC4w/PV2KCT6mae
TLSH
T19142B52EAD10793B9CCBC229FD617B67EBF5102121941E98EBFC892C15EB5CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b8ca0247d346451daa12c8eb1ed4044ae9db97deb2318ba6a09b100fb2a031d9
MD5 04b676028c8e1810f7acdd89b3c5aa77
SHA1 b2cd3114fcf16aa59ff8ae57943b0849c99a9c9b
SHA512 2525896abaf5f73a403c3f55cd7637f23f69ba5505363143bd02d4f114151b20665773889d48d99106bcef47170fb6874033ee235b2383806b970f6109b9ed7c
SSDEEP 192:VORQTYJ0kdwozv7tYpAPRp2hUz9CHsb+WNnpVPu12KCTkwaNWaVyIsnAUgE:VORQTbYLhYUXeC4w/PK2KCT6YaE
TLSH
T19842B52EAD10793B9DCBC229F9617B57E7F5102121841E98EBFC8A2C15EB9CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bd24ca061d08757b1ae0e90170799106e3bbd81531099bf9c1bf1bcaa93f0a50
MD5 e597d8fbae178ac2d98182faa3d13045
SHA1 7acdc631eb9eb77211a7f866c361a312a3358c50
SHA512 6b778a6c63ce671784cdcc4cacaafb46ee44f3533196ae7718ebcd24807144ec5d9a40256f2fc5568d35dc58140f214a7e8c9ea12220fd808cb2a66af5676add
TLSH
T183B0129080015511C40302FD298254AC3114AF208705230163E07972AC2A7D09058160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ba3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ba3.TMP
Size 96B
SHA256 c99a8b24af320c6c83cfe09c1ba780f3fc638fcb7d1e4a129de73ccf6ade3a30
MD5 f19e65e828fca80ab37d67fef8b1781c
SHA1 fe532ca1ee11216ca60e8b880ecbf82aff863513
SHA512 cd9b3ffd951a4396bcddb7906e98ecd8723598b180303d02251d0db57ab3f6dea551e0efa3e7219cd24fc19fc3a5924d509812f14a9be009703b8ded61ac967f
TLSH
T1CFB00299D6137656C04203B029F5A5DD7260EF39C603522693E01F67DCA56A06A35DF0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 a6224cc561ffe76edc23bc00bc2697599ab93eda6bfe821689405a770503b0bc
MD5 10b2893e63e73250f08b208db0c43bd7
SHA1 04abcd58f8841b28daccbcebf1cdb1b7630d2626
SHA512 fda52e7266d079c578634f448dc15bf002061201d9d6973b66c761b71a63d6b8ba038194bb033d97a4565116148ea58dbf7d47502e11936761bb58378b83b134
SSDEEP 1536:AXpcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:Ep3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1139302BA8E1A49F799BE5691769E7809CE22130D70AFB98C716C534C21D41CC2B63E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 c60592f0d6158210e346d1023a8a65cb5647112ab4c4bf2c6b5187309ba08334
MD5 f4e0175326db2542a944e7f9fe118ad0
SHA1 2facea706de4faeb0e17009dc6e08f294c4dfd77
SHA512 b7a5eaffbbcc755cc16f443a9a3a7eea5b60994bd74dd57f1366366a629d191232d9aa184b5a8611382f1dcece7e940cd526e617fd00c7fad0c64fbc969c8923
SSDEEP 1536:0NWcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:IW3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1339312BA4E1A46EB957E46C176AD7808CE22130D70AFA9CC316C639D61D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 17a2ea6b2cdba0ac10ae0e4080529d917ee574561f995624606f7ea74a08bc22
MD5 209cff2aa9090eff53e761e586b585e1
SHA1 d63035788a759a354d9203f3cf85081cb9493dd4
SHA512 edd14c9f832ddfe58bd0903c880e2f8f55b0acdffabfa9f6b0f9c75374b1b3d6d57b5d9af602a798cd9f531a486e80ec4f4b59177df5dc486c5a38ecb0ca4860
SSDEEP 1536:gXpcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:kp3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1489302BA8E1A49F799BE5691769E7809CE22130D70AFB98C716C534C21D41CC2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 10604b4a00621cf30f4c8af0830c3df787d98b4d5186a06da19168fa51c1334d
MD5 6abeeb9033dcbdf7f9bca70c9178fc91
SHA1 8e20b8af717fef6460df7f09f7a9e6e8eb67ea08
SHA512 c91125ccf31e2809375476e4e54a3d179d1725ea9ab2e7bd293fcd9a15072d769cba338e62fdb08f4cc7fc91b2e366c063006dfdede5abc8fd7d2ddbac76fb1c
SSDEEP 1536:gwcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:V3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T13C9312BA5E1A45EB95BE4A91766D7809CE22130D309FA9DC726C538C21D41CD2B73E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6841d113cd25c8e5422d1862d6a3f57a0bfc784f1466590c264faa2229f59bc8
MD5 7c7861ee791f245cc121cbb608b0696a
SHA1 a97c5ac760925f299614f288cc05f3f12ea5297d
SHA512 0c2e50b645a826ce7dab725952e8ab0c052f70645434e0df98da6c440d29fb3769d4e1684a39dcb628c32f36a49be785324efc9b906ba7125d80092281b3314d
SSDEEP 1536:lwcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3x:O3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T11F9312BA5E1A45FB95BE4691766D7809CE22130D309FB9DC726C538C21D41CD2B73E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 60d9c7a5333e5fb575280572ceeed07cffc7379799c91baa7254125353371c71
MD5 3194cabada3fca0c80d02e1f966fa6c8
SHA1 198113aa3c1bb8f85516e4b04e8121e340305d6d
SHA512 742175f002e57379ab3e788b30720baf9b279aa61f6a74aac8aca40d94fcbd56e909d27951ee4b3f8ae2977279a589b549db7d085502c776d3453cc54eb15e72
SSDEEP 1536:grwcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:gw3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1D19312BA9E1A09F794BE8691769E7809CE12130D70AFB99C716C534C21D41C83B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1652-61-0x000001DAD3330000-0x000001DAD33DC000-memory.dmp

Download