a66c529c4894ab3aa15a0480a6e8a2a214dd1314727d4cbbc29fa5b6bf66a07b

Analysis

user interaction
yes
max time kernel
65s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/06/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amberjohnsonopendocaccess.html
Size 9KB
Sample260624-wngr6ses7n
SHA256 a66c529c4894ab3aa15a0480a6e8a2a214dd1314727d4cbbc29fa5b6bf66a07b
MD5 2db2769b2908ad9e496c006332bed7f8
SHA1 c2490ce97e19f54907d6b15465ad62a4e822ea28
SHA512 2658c83ee4f28bc6559ea0ea7c28bfcfebbb42e54850eb8848d63a1f3a347e82fdc60905a3cb77602cf6721781d2cfd1e8eafb7ab442090c458e09a942ef8c2a
SSDEEP 192:6KdWy+ch9fsedbdHTqHSD9mg5NG/RMy4n0:b5eugRMyD
TLSH
T13912421BAA440415B873E37DEB638246F77A4123C20146297F9CA3590FB6914D9B3FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6040	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267978664341631"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4880	752	chrome.exe	87
PID 752 wrote to memory of 4732	752	chrome.exe	88
PID 752 wrote to memory of 4732	752	chrome.exe	88
PID 752 wrote to memory of 6040	752	chrome.exe	89
PID 752 wrote to memory of 828	752	chrome.exe	90
PID 752 wrote to memory of 828	752	chrome.exe	90
PID 752 wrote to memory of 4124	752	chrome.exe	92
PID 752 wrote to memory of 4124	752	chrome.exe	92
PID 752 wrote to memory of 4508	752	chrome.exe	93
PID 752 wrote to memory of 4508	752	chrome.exe	93
PID 752 wrote to memory of 5976	752	chrome.exe	94
PID 752 wrote to memory of 5976	752	chrome.exe	94
PID 752 wrote to memory of 4488	752	chrome.exe	97
PID 752 wrote to memory of 1712	752	chrome.exe	106
PID 752 wrote to memory of 1712	752	chrome.exe	106
PID 752 wrote to memory of 892	752	chrome.exe	107
PID 752 wrote to memory of 892	752	chrome.exe	107
PID 752 wrote to memory of 5500	752	chrome.exe	108
PID 752 wrote to memory of 5500	752	chrome.exe	108
PID 752 wrote to memory of 6036	752	chrome.exe	110
PID 752 wrote to memory of 5188	752	chrome.exe	111
PID 752 wrote to memory of 2256	752	chrome.exe	112
PID 752 wrote to memory of 4192	752	chrome.exe	113
PID 752 wrote to memory of 4192	752	chrome.exe	113
PID 752 wrote to memory of 4636	752	chrome.exe	114
PID 752 wrote to memory of 4636	752	chrome.exe	114
PID 752 wrote to memory of 4844	752	chrome.exe	115
PID 752 wrote to memory of 4844	752	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\amberjohnsonopendocaccess.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff46d3c728,0x7fff46d3c734,0x7fff46d3c740
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,10227915115692409880,13199094908273863786,262144 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,2074667226428101159,10655033605165665046,524288 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,1684799270172385539,10665156291084588597,524288 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,3252656460103228927,13390784759507956702,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,11895788686285942563,15477992936283950374,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,8708745885212547336,1267092670158771573,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,3716340490827180288,50827256823015977,524288 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5628,i,248123534531611921,2271004322941470615,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3712,i,1589854683952777285,2457779225381803022,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3360,i,17548260892317204124,15789372408245705257,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,2995290452101449035,12031236671916800203,524288 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,8294533220886885112,2408040639793316349,524288 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,10700388636547145240,10348738436896039855,524288 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4512,i,9733195373523162307,5703544256821209552,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4632,i,10409432144403199913,18150973368491925100,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5864,i,7347812179377510538,4896448074575989666,2097152 --field-trial-handle=2008,i,8526904905488449557,953727173873835561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 aaf079ed9afc9a46283c1f073ab5a7d641290078f9a4f9cf3731bc5ee3bcd574
MD5 88706e65fc1745821f56d27cbfe98427
SHA1 9be8743a9a2dec74f7c21de7f2a7e29408d25ee9
SHA512 349b21ed55502fa3439d34dfff2ff1ecbd828e3fd02fda86bb4dd113bc2f526b59ca9e2ac8340a2077bb222196238dba3f19262ef11d39414234fd2545242a17
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 961252760ff98395557501c45f943fdb096227b4c6f574081eb1e7b465eee874
MD5 789ceb6cf62510ba633512a9dded3990
SHA1 f33b8ce8cb562890e1d02ff9bf57a60e2bec5b05
SHA512 c878d2e8bbf47853deb0a667d9568be1a2a85e8d2f831d0c9291a60c11dbdfed1bb6587c76c0d1789766c463a073503d22b4a90e4adfeb313019a67717c171eb
TLSH
T13DE02BAAC825AC270CFD5B2870144746E740031A7F91C94F3A3EC2098FB6B7B826782C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a47b601d637da618d77f963c456a1932d372af33e6ffd89c825e0e1976cec98a
MD5 ed311050bc9986a4f9ff2c755dca6ec6
SHA1 e5a83845910e194fcd5c35c75095d7be03c14ce3
SHA512 00cdc2b0ffe4270bc6c04a2d0b6cd186ab960fab5a85f2a6759d47d0f4cf8acf836708af347095a629adf6b57146e932b85e13ea104b099fb90fe8b5e56cb46c
SSDEEP 192:4RzHXG7EYK3v7cpAPRp2qO69BHsb+WNn/5PGx9LZIOHVyIsnAUge:4RzHXLfwUXl1rwBP29NXhe
TLSH
T18242FA2EBA14257B5CDBC229F9267B53E7F5102635842EC4E6FCCA2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4083b7febe8296a1b7738e7759ca9a742477fd968ee6ceec4ea8653471f3ae21
MD5 e9cde93a008a2fdcc24ab3d7fc6feb95
SHA1 b1b85a63c9c61df9ecd8390ec90c6b7a0c55cad3
SHA512 4578ce62dc3ace72ed3e0be690bb82ca89950d7efb6413a15898abb3f195cecbb0308c7b9625e92b221d398284044e4b05c7dcbc21bd34a01eb5b52513793acb
SSDEEP 192:4RzHXG7EYKvv7cpAPRp2qOUsa9BHsb+WNn/5Psx9LZIOHVyIsnAUge:4RzHXLnwUXlXrwBP09NXhe
TLSH
T1E642F92EBA14257B4CDBC229F9267B53E7F5102635842EC4E6FCCA2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6fd130d59b478dbf7159d9f8f8d8502f5e278daab67a96c3c4d3ee6718389933
MD5 6d47c77ac264d9cc19473d8aaeef2035
SHA1 d9e8351e900565ad19e199933baee11a5df76c6f
SHA512 d0bc07af233a1aea45f4e482ac7cdf8aa77aaadc2da6bc567ee38a6ab177ab0e6752924d92c2d0014589afe4227a0b80d4e36d27f66b6396229cb265bf77095a
SSDEEP 192:4RzMXG7EYKvv7cpAPRp2qFchPUsql9BHsb+WNn/5eLoO2Hx9LZI4HVyIsnAUgE:4RzMXLnwUXl4wrwBW2R9NBhE
TLSH
T11252E92BB924297B4DDBC215F9167B57E7F6102225C42EC4E6FCCA2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 315b545be4020df9e1a7ad60f59acfb87f919567dc908172d78dac1c76fded73
MD5 863a7ca1ac888e5acf7e1e78092b7b0a
SHA1 4730a2e8e158bb3769ab6d3e09945bebe71eee79
SHA512 a4f00f9bba9912122341b306cf5ba306b208501af915496c0e243f3c84c57a105cf84c3315f6ebb598a55016ca6ce6916f1ec42ea27e52f9d74fa843717257f7
TLSH
T1CAB0124380415201C44303F4125354C87114AF209A0A1B06D3E06EA298255B08414150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593e76.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593e76.TMP
Size 96B
SHA256 965847f25b436121030cefaa9db895b7f5d1c40e7d76a7cbbd43cd13f9cc4eca
MD5 b4c4160b723474cbdd630564716e4a3f
SHA1 661a1dcf5308bae9a9e9fe4e6d396d494983a5b0
SHA512 51614e07a89d5e6f688071257ef9f5f0b17f5a1d56bf87ab3ada755681b8660bb7422693e1352c390ab26622bd700e5e83c230f8db5cc4936c1019eb7019f53c
TLSH
T1B2B022C0C0222202C20203FC2882EAC8B030CFA0C2030302A2F02A2FCC202220A22020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b44c61ac71a5f3a2f5e67130797cfd682b547186791efc2fea3fc17492d002a5
MD5 77efb01cb9b8aed9ac8b5ededf47d280
SHA1 00c5411534b606b78f8e640d5eca2623135455de
SHA512 88a8bb4239688122546e8d43807c4f8e6f9ed7148a3577edf403dbf728800426bee65caea799dd1faa157999068ce575efee36323b7fefa5a6e153ce8563c6d5
SSDEEP 3072:SDFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:WFmUi21rSm8uUVNSlzY/
TLSH
T1D4C31300BAE3E8F2FE5930447BEE2A145D6C4D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 520cf941299859fd7110c31271f14dac54cb5b0d8cc34e6b25f3b99342446889
MD5 3e17b1d252daf49239072fded795a299
SHA1 f6dbcd93190efee441c27ad01bfd52544c1b8ec5
SHA512 7033e0310ba60fb4badd6545aa9e514f2609e5434d51e3d3754331fa70fcd05b8c4ffc029a48bba8652b1555289ce6e22c9983532f249be20cac7ad549b7d76a
SSDEEP 3072:S5FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:4FmUi21rSm8uUVNSlzY/
TLSH
T183C313107AE7F8B2EE99304476EE2A158D6C0E818291C54157739E419DEF3C61FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bebb71e2e696e41bfdbfaed2c7e6bfdfeb7325b330d3cdc694718d42fd4d08db
MD5 b78325bef6a32a90e382dbe460d96094
SHA1 105ca28d20ab53e51ebe80e6f21ec610d6e47cde
SHA512 b266fea0ba6663b7ef6bdb9066b99e935f44ce4daa8686359029f0e60a7591487b337ab2ab662c6e37908c6b1b3624055b5cf5911e6fb76b6c7534f04e7dd0c0
SSDEEP 3072:SWFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:hFmUi21rSm8uUVNSlzY/
TLSH
T14BC313007AE7F8B2EE99304476EE2A158D6C0D818291C54157739E419DEF3C71FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c86e5bcb6848c4d7e1ef9f2ff5185c76ecaa0d4d1a695f22783f8f29db868539
MD5 4d661dd25e9723516f87142ec2dd3a47
SHA1 f40f7f6e4196484314c48227fe77a2f364c9bd92
SHA512 df9a536dccd3d6021d64025deeaca30986d39b736aa4661ba258fc129463dc6562202304ddf726108e7ec9d94a69d5fc6af9c006aad5c8e5fef35f128e1d055b
SSDEEP 3072:SiFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:FFmUi21rSm8uUVNSlzY/
TLSH
T14CC313007AE7F8B2EE99304476EE2A159D6C0D818291C54157739E419DEF3C62FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 88111d6f89cc8866edbda978129bf11c5b70caaced8defcc28c576551c5202ff
MD5 c9f8a9573b87c5d666866cecf13a634c
SHA1 2dd7037ae015876cccf83614b3e7aef7fd36bd5d
SHA512 445219ddb86d7d09f4352eaae77acd2a1ba13196aeb8f44eb3b660b36151d8296466bacf1949feb0fa770803007ac01c4587fb401ef0b89243759a4cb99f3149
SSDEEP 3072:SsFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:fFmUi21rSm8uUVNSlzY/
TLSH
T166C313007AE7F8B2EE99304476EE2A159D6C0D818291C54157739E419DEF3C62FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download