hxxps://bejingfuerdasha[.]com

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bejingfuerdasha.com
Sample260603-gs97ysbs8l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3092	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249403543969367"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
3968	chrome.exe
3968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 5004	1152	chrome.exe	86
PID 1152 wrote to memory of 3220	1152	chrome.exe	87
PID 1152 wrote to memory of 3220	1152	chrome.exe	87
PID 1152 wrote to memory of 3092	1152	chrome.exe	88
PID 1152 wrote to memory of 560	1152	chrome.exe	89
PID 1152 wrote to memory of 560	1152	chrome.exe	89
PID 1152 wrote to memory of 2292	1152	chrome.exe	91
PID 1152 wrote to memory of 2292	1152	chrome.exe	91
PID 1152 wrote to memory of 1352	1152	chrome.exe	92
PID 1152 wrote to memory of 1352	1152	chrome.exe	92
PID 1152 wrote to memory of 4212	1152	chrome.exe	93
PID 1152 wrote to memory of 4212	1152	chrome.exe	93
PID 1152 wrote to memory of 2200	1152	chrome.exe	94
PID 1152 wrote to memory of 2200	1152	chrome.exe	94
PID 1152 wrote to memory of 456	1152	chrome.exe	98
PID 1152 wrote to memory of 456	1152	chrome.exe	98
PID 1152 wrote to memory of 4532	1152	chrome.exe	99
PID 1152 wrote to memory of 3376	1152	chrome.exe	107
PID 1152 wrote to memory of 3376	1152	chrome.exe	107
PID 1152 wrote to memory of 1316	1152	chrome.exe	114
PID 1152 wrote to memory of 4516	1152	chrome.exe	115
PID 1152 wrote to memory of 2384	1152	chrome.exe	116
PID 1152 wrote to memory of 2712	1152	chrome.exe	119
PID 1152 wrote to memory of 2712	1152	chrome.exe	119
PID 1152 wrote to memory of 204	1152	chrome.exe	122
PID 1152 wrote to memory of 204	1152	chrome.exe	122
PID 1152 wrote to memory of 3968	1152	chrome.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bejingfuerdasha.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8bbe9c728,0x7ff8bbe9c734,0x7ff8bbe9c740
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,16923504319635832051,3796075699526622937,262144 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13062383722847681173,2636863420092537774,524288 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,3991381844288871288,15998504164220321625,524288 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,2924965687224567851,6828923084536754761,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,14105473464671472928,12776340579048268048,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,16916046469725765305,17092843063212702456,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,8814682628812970349,6220249666622344619,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4604,i,5082362897338238854,5315669819629936592,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,7130533784144401080,18285789026001756314,524288 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5692,i,18170769676979924316,7164169273495761286,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,11431603022110498051,6476828360876650847,524288 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,17951655149095268617,16310575811030243534,524288 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,5854659519164896856,11483953987328392680,524288 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4856,i,11649231871046380682,16285137634034718383,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5736,i,2783888144913585709,11410217060507305035,2097152 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1080 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4856,i,2176073216944811582,11770088054073724313,262144 --field-trial-handle=2004,i,4354496737387733145,12340895519804585189,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 384f1a777a2a7473bccdb831c919710baa9c4fdaebea6e1278830725592a7e72
MD5 354a838134dfe20c71b8f61bfd3d2a33
SHA1 f98d5f40f64356a2c30f80ccc12e2130790c1413
SHA512 4105fc77a47ca70757f5dd28d8b609ee8caa27b5f073b3669591fe02a219dc02c792df31c2ffea906625e5c1aec0ce3c8069843c4e87dbec57d19fd10bc740e7
TLSH
T15DF0F9B6C920AC2B08FC07293098074BE754136B2B40555F3A3C930D8FB563B4546C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c3a8e75e0e830c2f9d2143db7402309f5d152c4dce668521f43f39c9a7dbb982
MD5 be2deab8a327adaa8adccb90580aabca
SHA1 95c5e6a1a8e1e9f5469c6f8871f7efe46e162e06
SHA512 6c709f699bbef081ed7e6de0f6f5eae0a088ac60752991d58fc82d9182eab6a3f15987c93e5654e1eefc85239df5568cfbd3850a694664e1c8f97ae8d0b4db76
TLSH
T1955159B7C7D8C96D890156F4A7256E2FCE290E24532D3C56C8D4AF4F53E2971E20168F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 07accd50abf36f1eab4e8135a5652363c219a7046ae0411c50c1de61999f0108
MD5 87eb7771684e4f63722a4a30f1ccd233
SHA1 c5c5d6c7d011c1d41746c7e223c997d42711c3d1
SHA512 e7685ba433b47309798f873513df83d4315c85b99fa4bd951999db1793d893a47963e6c47ff003bbb6c8b20ba87065f26c3e414604d5a20bdd24b0d3ce33b095
SSDEEP 192:wRAMtRf7UJ+yv72ymphPRppq795Hsb+WNnKnP0De4NW1VyIsnAUgE:wRAMn5eQfXe7w8PjjE
TLSH
T1CD42E92FE910657B9DD7C22AF9613B53E7F5103221902E84EAFC8B2C15E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 055856a4b39f9f4abb0ebfddd7ed4783e0a6c292232b6077c3543803d44ed5c9
MD5 d2e3c0caab0f2ec57a3ac0935e5a5370
SHA1 cdaa263a8911a5d37bc54c0c99e9d823573728b5
SHA512 4b31a4c8bce1872b9357384c467b6344f4ab131a426f30ac75fbf59748ae87a84faeef5c59f7ad745e9b18d051b60381b913475c655c504b2ee5467edfdafd9e
SSDEEP 192:wRAMtRf7UJ+lv72ympAPRp2q795Hsb+WNnKnPbDe4NW5VyIsnAUge:wRAMn5VQUX37w8Pgfe
TLSH
T1DF42D82FE910657B9DDBC22AF9623757E7F5107221942E80EAFC8B2C15E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69b87e0beed879ace0175f6d4e16b3d9463d92a4004573b89b30dff0bee1eda2
MD5 77c7209110d6137d8ccd5867ccc7723b
SHA1 28adbccfa84c25b20590047e1bbc73f97023a170
SHA512 5c312f7749e0b0a1bf5231004d1afe031d71cb0f3946a8b3e6afd22123a9f0c7a8b479ba862bd95f05f0d25108e6863bd3b022a17f4e1d27a2d289f60e8e5162
SSDEEP 192:wRAMtRf7UJ+Bv72ympAPRp2q795Hsb+WNnKnPQDe4NWHVyIsnAUgE:wRAMn5RQUX37w8PHhE
TLSH
T14642C82FA910657B9DDBD22AF9223757E7F5107221D42E80EAFC8B2C15E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ed1a590faf1b4cbc033427f933b250b359d23cbd6875b171b662fba831efdca4
MD5 479c9398f858ed999bf54de46881bd89
SHA1 f72b97fc9209d4964db3401c643f064ffbce9ed0
SHA512 bd66728cf07d53e987fb268a1e08057a7b1911e909345446b9bf5261cbf36511e57ec9f31182bf384b0c28776ac329426cff3777e94ad4e74b7835d518760761
TLSH
T121B0121094019101C0A202B01142588872155F10A70A1B0243E07A72F8291658114051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589611.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589611.TMP
Size 96B
SHA256 ac2158435f2555b163949e7a5e136e6e69e330f92319a3c9941d45745026ce68
MD5 61610f34b2fdf24a6f56ccdef4f21ad5
SHA1 a393eebc594cc443365d65e9544815e722f8b018
SHA512 ffc750f006e65e5c903d63ba1f0eabf3fff51c2e8e2acee6f750248c227f98310f68b0272ff04b3d2a8449fddecbfc10b59a3b7a1ce425f634f1d0b32242ed90
TLSH
T1AFB02200C0022222C00203B028E0E8CF3020CF20C203032282E20E23FC3C2F003200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 7442fd5620b8d623955918bb84bd1422a715799edaa2cd2bb002061a9ece204c
MD5 cd24b23d209ea9a4527245ff1c6af0d2
SHA1 b035d2c9671fe706b484b8186d7da84c0da7ffe8
SHA512 4f9d5d88ffcc8efe047dc74a2c02d7a7807f0fbe2b0a3caf7c6b8febc8cdeaa312d487bac6b4abff3f3b7615ce20e23f13af9c09aa9c5cc712b401b4738f61f5
SSDEEP 1536:YRufUNaD54LBC2jNbo6HcETAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0By:LkM2jRo6nGqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D5E31236DFD61E338DC2DF20F1234FCA57F95195E438C205CAB967AF6853091A9828E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 edfe6f5be2bd1c771727cdc70448ce873302254a2b0ecb841c422f44ea139a50
MD5 d4b5b4a6de7f7ae48f787811e8f73f89
SHA1 81c0c50cf70826ba104adba1ac4974b9c721307d
SHA512 2e15a5a38c0d55da1c321aad204e5b91a3ba3106c5b72cdbbf9f8a57f4edf6cd885330da476178cbc5dcfbefb69ba02f3450a095e379247007fc5bcabc4ecbb9
SSDEEP 1536:TgQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:hqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1A3C30237EBC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5398b33d494a5e290ca09c9399769f63f51b49eac2ca03f9e5572769c621f241
MD5 5f7b06413a785a002bb7bf169a2bc0b6
SHA1 2062f2836b11c91577723d56a2592c3959b10eb7
SHA512 8f0dd5775f64409622057aff5f98868ea8bcecdb88cd2019632a5d15c10d982388391e3de8d648b0699c7a965ee47de1db1bd6c306e383dabb94de891a41e268
SSDEEP 1536:TyxRyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:wPqfd7NtZL8cHQRZEQ6Spsk
TLSH
T174C30237ABC61E339ED2CB70B9130EDB97B544A5D034D301AA6D37FB6883495694289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7101c2c5501767d897273ca8d16289defe4c69447ed0fd056a23aa30353392a9
MD5 6d8b8c6a7d4c4053a688159e48bb6ad5
SHA1 ff5a1f4d5635ed592cae840fc8795ceea873a35c
SHA512 12f1a3a64fb33dfa7bacf2e858cd9c1c94800d23dbf3c274f727c2d2f746756d162775c4b144be3732f4bed042d25f60218928a0c8b522f64bcf8609c8ef5501
SSDEEP 1536:YyxRyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:FPqfd7NtZL8cHQRZEQ6Spsk
TLSH
T159C30237ABC61E339ED2CB70B9130EDB97B544A9D034D301AA6D37FB6C83495684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download