647d9315b5465c690b74e35f85404a9e7cf3a0a4ebb94265c809c79179728640

Analysis

user interaction
yes
max time kernel
900s
max time network
896s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freehackznovirusforminecraftandfortniteandroblox.exe.zip
Size 624KB
Sample260504-sm889aew21
SHA256 647d9315b5465c690b74e35f85404a9e7cf3a0a4ebb94265c809c79179728640
MD5 e45b89019eca58acbb11be58e98c4efb
SHA1 84b01115a7cde843b49da89315d4093a23e58791
SHA512 a0e7b1c628f2834152910e1961355127376d56504e120b17089d04d55658ffac623c12d9665800ea1e18801f037742a7098dc42d90e77b1393e8f18bfe4aa3a4
SSDEEP 12288:k0p1ufq3C/IlH1/jPNU0LWVomkeeZb3E9/TojcHjA7R5NMNyr:3uiy/UHdLLWVomk/Zb2TojcHjA6G
TLSH
T10AD49B6DDE32A0FA2153F651EDD9DFCC84046BC8B362421FB5982449245BEE42A0BF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1156	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223813887475369"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
3952	chrome.exe
3952	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3416	4496	chrome.exe	90
PID 4496 wrote to memory of 968	4496	chrome.exe	91
PID 4496 wrote to memory of 1156	4496	chrome.exe	92
PID 4496 wrote to memory of 968	4496	chrome.exe	91
PID 4496 wrote to memory of 408	4496	chrome.exe	93
PID 4496 wrote to memory of 408	4496	chrome.exe	93
PID 4496 wrote to memory of 3372	4496	chrome.exe	95
PID 4496 wrote to memory of 2484	4496	chrome.exe	96
PID 4496 wrote to memory of 3372	4496	chrome.exe	95
PID 4496 wrote to memory of 2484	4496	chrome.exe	96
PID 4496 wrote to memory of 2196	4496	chrome.exe	97
PID 4496 wrote to memory of 2196	4496	chrome.exe	97
PID 4496 wrote to memory of 3104	4496	chrome.exe	98
PID 4496 wrote to memory of 3104	4496	chrome.exe	98
PID 4496 wrote to memory of 3368	4496	chrome.exe	100
PID 4496 wrote to memory of 3368	4496	chrome.exe	100
PID 4496 wrote to memory of 4992	4496	chrome.exe	103
PID 4496 wrote to memory of 4592	4496	chrome.exe	107
PID 4496 wrote to memory of 4980	4496	chrome.exe	108
PID 4496 wrote to memory of 3764	4496	chrome.exe	109
PID 4496 wrote to memory of 3952	4496	chrome.exe	110
PID 4496 wrote to memory of 1984	4496	chrome.exe	111
PID 4496 wrote to memory of 1984	4496	chrome.exe	111

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\freehackznovirusforminecraftandfortniteandroblox.exe.zip
1⤵
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe7bf1c728,0x7ffe7bf1c734,0x7ffe7bf1c740
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,10153410011299640942,7514362037890174556,262144 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1828,i,1873756083920435853,5275133339586111744,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,9666880335943221239,9548078784684545756,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,11890309886406606117,14910525114649838069,2097152 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,10774788960044347847,13555845555530476346,2097152 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,610525025589343903,18286816614324782787,2097152 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,1203266415197902824,4075394646814163087,2097152 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4880,i,9318561336465186957,17232147666343125665,2097152 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,1054829522854748562,3256232800961747895,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,1732122517689915335,16501119582924649634,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,14439657600577658080,12380951304848173706,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3204 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,241391971796771370,3604764343595702510,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3204,i,1928469379884228440,10949072686115899618,262144 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,539311968205453090,6951283980108868570,524288 --field-trial-handle=1904,i,13087857711783685144,6604484620121066630,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1528 /prefetch:8
  2⤵
  PID:1984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ece5f1f-24ce-4038-9b0f-edd543c90b07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7ece5f1f-24ce-4038-9b0f-edd543c90b07.tmp
Size 89KB
SHA256 a2fd999d74504ee85593086c83f5a225c982f69b098c6f44e99b315a6a2a42b4
MD5 1c0672c3af43254e4318b63b0a8cd0e2
SHA1 9b01a9dff1124e0c61793f40f267a74004bb900f
SHA512 fc2b1d9a940ff4a429a704289f010c0ea85965a36edfdd434f01fee44057f4f289462b63661dd6e2a5ffc1b368410c5b95088c1d91547b107f9c37e13aa99737
SSDEEP 1536:ip/hcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:ah3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1599312BA4E264AE7997D4A8176AD7808CE12530D705FA9CC325CA38C61D02CC2F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4ad7898a3929d3b23a84b38f88ff21cb8afce16ba43067c265a8b5f7da235185
MD5 f0d60d95f9729f15a9703631015a42fe
SHA1 1ece9e52ac92a9eccd8469e2ae000858e4b6cc9d
SHA512 cf91e6b1a1288bd6e8a47acca441cc80e175591bce5fe589ea2a7014761b3fef6d3ff41b0b5b2ebd4f8eb36448144d7e939c6df8ef371763fcca5e37c413e9ff
TLSH
T1CCE09BB6D921DC3B08FD5B5D60514B86E740235A2BD0854F3E3E864D8FB4A3A0586D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 8f65db6cca15fe54cb3010c7814e29ac6a67c7ac3119373e3b49ec0971bad04d
MD5 b3dc722044ff198dab21e635ab9cf33e
SHA1 917650eef259f17c688e01cd2bad80c1026df4b9
SHA512 a26ef1d993c627c561a1b6fce71095b7178c461f5bd65c3c46ca31b1c219beb8109891b6a6423f0880c4656900ba0ec91f47ff044d85714d23b6cccf39ed1c4a
TLSH
T1EAC01221E3C00386CFA013B128D3448330749D3F493A17BB82C1B69CB852279A397E81
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 6f901d0f1bb5f9cca8deabd92f150a35fe34a4015b5e11f401484cbce61d9fec
MD5 a6dcaf4523a2a32ac1e7e3c57782a611
SHA1 2ad69d5e98293639ec347799df12aeed5c10596e
SHA512 ce31eecdd70f1ba34570fc9820115e9ef911dc84508c9bb87733f96b02c5c8521dc42a44e1e491faaaffdbad451a51a6b98ee59a16dfc0e2e345cf001b3aead6
TLSH
T1F7C08C10A3900102CF6013B03C22494310604C2A824A037B4185A18C8CA267C6134B42
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e50f3199d476d658780e0a2560102847b902133d0c910534f25d02ea5dec3cc1
MD5 7cb352b121b8c9d38576bde0e1600bff
SHA1 15e324359776e7a542f44a129b6810735c1854fb
SHA512 4cb0709bca4509c964be76a8278fd0e3017ac7f75adc11f7284eab393bafcf9ad2229a7ae6f847ccc562d941da4cb38ba914642e5222707126605f4a84e4fce4
SSDEEP 48:YALlq7hrqFhfh5aXYfo7zsMgmzsUfsyoszKsPqzsjtsq+socsP4sFjYJ:DkBMF3aIaBzzjZD1aTFEJ
TLSH
T12E81BDF7C3E4866D841196F4AB156E1FCE6D0A28032C3C66C8D8AF4B53E2872D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1c9eb4e60b257a07b203c42d4bc14e181d8abb83c9fd4a2b788b2a5587f19d45
MD5 525c62e107d4643347b972cce9e0f900
SHA1 8022d850a4d39df584b2122be429e42147769c62
SHA512 316bd646bc7289bce8d6ebf1be7882d93b343ecfd1386ac7f59c6480ea02c1ac48b678cc8188cc9ce127c10dd3dfce8f81f813c64a9faa6ab1b2de09bd697b0b
TLSH
T1EA81ACF783E4C56D851196F4EB15AE2FCE690924032C3CB688D4AE1B93F2872D20179E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 68448051e4b1b4c44974b2c46c1269dcba4a1da879f64d8b062e213f3e9662c4
MD5 737ee4a87778bc66ed0d099ada3f5541
SHA1 ddfe89a24b75c8efc79893ff393adc7b58347b5f
SHA512 3a871891a54df82ad580c9c30f2f5f5e15e08711b815d749e0b0fb78bfb55e70301147edef23bb8e194a95b14a7f6b04725a88a451035023dfbc0f8ff2f79050
TLSH
T1C381BCF3C3E4866D841196F4AB15AE1FCE6D0A28032C3C66C8D8AF4B53E2872D21575E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4cbc391511f1e7fad0c936b7046817eb5ab674af35ec88b6eba527c4e628174d
MD5 e107cfbc626c93aa487dcae09e5bbd26
SHA1 7e02334ac2199b7ab930e759e153a0afb7d7b2a2
SHA512 e808b99013eac0df6e97bf65c62ce9f6feb8cf4a27f47622953ec0278fa07013d723af0e74706a63aeccbc4972ff6baaa3cb0b209d5baf348781221b3620d0b9
TLSH
T187F09EA7A77D74B714BD89BB3E0478092CB2A435039068F0CEFA412CA0D99F70B1B467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d8aade7d154303372a7bee77ec2237257f393bd3af2a7f73f031d1eee8410cfe
MD5 f89b678217ecc0bfc57484f834070d45
SHA1 e174a7c5c74777e8e7b44d6c39be5982fb6210de
SHA512 e30cd7d657c211d9c73475a645c0242ccd358cf24b946af5cb28fc9398c4c559c008c98da06fc04527db4c29caeca31ae24a59df591b8141f68df35cfa9f35f4
SSDEEP 192:jRqO8JyO8dYiPv7CMpAPRp28w93Hsb+WNnO94VyY0SzsY/LVtVyIsnAUgraJ:jRqOpO8HxUXMxw0zYPje
TLSH
T11952E76EB914693B9CEBD32AF951B71BE7F1202160961EC4E6FCCA2C14E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81215ba7658bd521019642655f3db8e02696081ec36bc71c32a3f46d3ed57070
MD5 36128c2a6c9b54040cd804cd1f607509
SHA1 2b6e174b4be5cf7c38f290711d5b62deff14003a
SHA512 743f8fc1b0e936e477d10290b6f285a9a655975e95a1f9af59e85dda40ba25ebcb55c719d3b5b41ab0970e7f2ff1e5734da122a6323817f9b797738102dc6b46
SSDEEP 192:jRqO8JyO8dYiFv7CMpAPRp28w93Hsb+WNnO94Ol2USzsY/L7tVyIsnAUge:jRqOpO81xUXMxw0H2vRe
TLSH
T17742D76EA914693B8CEBC32AF951B75BD7F1202160961EC4E6FCCA2C14E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 55a2bb8aad8bc4a1e34f44dbed62c273f380292aa626c6d263ca8ad6c27b0141
MD5 d2c58404f19a680068d8628c4c4c8167
SHA1 c692ef36fd12ab545b0a638f108429269ea63480
SHA512 1a9f939c09bd61996e1e93b76fe1e4e529c66bad6f8b22d091f1053f55fa7ea35451dcb5050389451cdf8c8488d4f3e4ecfb477c4b23606c54beafc8ac9d9d47
SSDEEP 192:jRqOvJyO8dYihv7CMp5PRpJf7z93Hsb+WNnO94/kENSzsY/LxtVyIsnAUgraJ:jRqOcO8xxjXVxw0rEkHe
TLSH
T1B252E76EB914693B9CE7C329F951BB1BE7F1202161962EC4E6FCCA2C14E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e9f3b1c893622c1a79b2935f49acdb1d07d3b2be24ec90d40844f6ffc18c5ef
MD5 928ac0d94fae20445112008e77a0c797
SHA1 219dfcaf2a925190a9060622f9befe3962c98dd0
SHA512 ac9be72fd51d82f941e409c6b8e1f09a514ae19907c97d8dd3adf1c04caf232b76ddc33a15569b0f726dda41dbe5215ec709414367ad2f2c5b750adb7c556293
SSDEEP 192:jRqO8JyO8dYiVv7CMpAPRp28w93Hsb+WNnO94hueBSzsY/L7tVyIsnAUgtaJ:jRqOpO8lxUXMxw0/eQR8
TLSH
T12A42E76EA914693B9CEBC32AFD51B75BD7F1202160962EC4E6FCCA2C14E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ea3170126e494b05869e520d0a90a8dde7483012c856953fd189f148493d89c1
MD5 5c85e2a81931090468702a7738bb25a0
SHA1 ee1a19b87a42c68eed7c2639683cddc3391e51cf
SHA512 1c4cbfa558e56f9b0425338e987ff656a4b755564da8956dfb1c387baf4cd729032401e1c5f4e66a8b8cbc017b88eb8466c446a35d810ca73ae90648f857a237
SSDEEP 192:jRqO8JyO8dYiWv7CMp5PRpJf7z93Hsb+WNnO94/kENSzsY/LxtVyIsnAUgraJ:jRqOpO8ixjXVxw0rEkHe
TLSH
T18752E76EB914693B9CE7C329F951BB1BD7F1202161962EC4E6FCCA2C14E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 12be3b83d7c457c5eabcabebe8b676093027e422344996cf78b2c6ccbd267eed
MD5 9fa0a8c113bf645e57d0b33950e61977
SHA1 a28af3bd963cd849d848d77172964b83e636c275
SHA512 dc1215fe63598252df4e9790900feee1569eac9257b8d4ea0220b906f740ca41e1aa75d6e5e4a34a66cd5df3cc2a51d5ff7750f4fd68ee5fc73a2f3b3277894c
TLSH
T120B01250C0415502C01302F4118257883114DF319709132693F0ED7198261D04225251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a350.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a350.TMP
Size 96B
SHA256 e8e426695634390cfc16656b83fd250d112421a55d8ca3fd1a1f4bf643507336
MD5 ce4158e44a8f578fba412dd4720dc693
SHA1 7c97d115d0b7f8bdfc13183ead76903fc2963235
SHA512 3cee36e62aee1204bbbea05d753d0e405ddafa5b8e540d19d5d1c3161bb7e1abc7c2186b7ce9ffa773cd688efe92b84fc10bb44df7f12739809f43ed2173be4e
TLSH
T1F2B00295D307B312C54703B03995A5DDB160DF2BCA13136797F11E66EC397608529671
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 95a299e28e9a6f66e6c842d91c5646b265805787f779eb9d3bc24dc276d973a2
MD5 cb905346838c4afeedf746ecee8fba64
SHA1 eba36a351f529a6339cbe4ae40b56004d82344c0
SHA512 84791d35618b274a058ccb674ecccf17db208da715e2937375b3dc89f8ce9b814141ec7b37220146785a32565c7638270447b842d03f0150c8ff8522e667a651
SSDEEP 6144:F1nogOrKDTQtRmeBPaCyt4P2ny1A3rOk0HOGm/SFyEE5:F1nokktBbyuOrOjuGdF25
TLSH
T148342276DF31586787F98E67B19A7E01CCA123CF1099604C666C7FCA50812CA2F77A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 4ed7335390421b980e28d3d0497960183790ac2538bcaf4a7f9256b9d916f5bd
MD5 c814c9ca5ded0cbc95ed9c39eaccb794
SHA1 22423453100d99144bb0883d126ebb69bae5628b
SHA512 eeeee7d65b14f4f887aafefe3b6c3ff2b84d3bfc1fad9beb5cc6b8c716463bfc0566271852ac4ec23acf9a02a17b48dabc2df1c31c620b475283e686bfb8d164
SSDEEP 6144:OqRmeBPaCyt4P2ny1A3rOk0HOGm/SFyEE5:RtBbyuOrOjuGdF25
TLSH
T18B1413BADD325C678BBA5E67719D5D02CCB1238F1189744CB2AC2FD961902C92F73A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 7f31e1942d691e5687f5f58d5a67e596cdf9be2063b21fa0887ce28332aece53
MD5 df7038f04200c2874f3c38fcc34221b0
SHA1 73578b9f8fe07ee7def075f2e5bc85c0cf9fa38d
SHA512 95af67804fa691c37f6a516d7f39b9d6359e02ec685a89ed02ce7620000c50edb0f5d503f131bcac0e0aaf6a73b55a5ad0495717f8a211720e1acf2ce557988f
SSDEEP 6144:IRmeBPaCyt4P2ny1A3rOk0HOGm/SFyEE5:0tBbyuOrOjuGdF25
TLSH
T1721423BADE32586B47BA0A6371AD8D01CC61138F20C9755C62EC6FD955906CA2F73F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 61c9d2499b119eb017b6a391fc67db1f691054abec79131b044cb9bf0c6ebf53
MD5 dc0052a029266c4f54f5ee9a3d0c1624
SHA1 7b6077897f3b194502694997ca6bc5dfdc9ca4cb
SHA512 de3c13d903ad85727c88162e604e2b6b25f9804c53a0b2cc4bf70ec225d375d3b0b22e9efed2b51315244a41e4277379926c443c2be4c69e6e0dc1c7e833de7e
SSDEEP 6144:lRmeBPaCyt4P2ny1A3rOk0HOGm/SFyEE5:HtBbyuOrOjuGdF25
TLSH
T19F1423BADE32586B47BA0A6371AD8D01CC61138F20C9754C62EC6FD955906CA2F73F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download