1803b850f10bc543cef04c831bbfcee6447fcc0f5dff858ed9f0f1fb77ce34e9

Analysis

user interaction
yes
max time kernel
66s
max time network
57s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/06/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
overrides/mods/Xaerominimap2.0.jar
Size 4.3MB
Sample260626-wae2esds31
SHA256 1803b850f10bc543cef04c831bbfcee6447fcc0f5dff858ed9f0f1fb77ce34e9
MD5 d1c40dfa7c03daa756c8b40f3c512cbe
SHA1 cb2982e8a86ebeaa10081708929f2cce6181f57a
SHA512 cd0a4565b5ad2d20ea9ae99af1662f519c275f07d5ab142f9c009139fac125e4cc82b257a9227842d617c676c7438c001b1f8b934b68e2020238b2bb272c798c
SSDEEP 98304:ArXze7EtEeHkuw7cziERdLhJbNe9ZKgVLhrlu2phhvZlh4S+6MkVyV0wxNuM0fF:ArXze4W2kuw7czVRdhtNaMiLCwrh44Tn
TLSH
T1312633EFE8096B032E4405F7D0977197AAD4F14740E752930DBE22B96A2FE02787CD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5240	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269694133633772"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RubyCraftSMP-Mods.jar:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
780	chrome.exe
780	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3956	780	chrome.exe	82
PID 780 wrote to memory of 4424	780	chrome.exe	83
PID 780 wrote to memory of 4424	780	chrome.exe	83
PID 780 wrote to memory of 5240	780	chrome.exe	84
PID 780 wrote to memory of 1504	780	chrome.exe	85
PID 780 wrote to memory of 1504	780	chrome.exe	85
PID 780 wrote to memory of 1620	780	chrome.exe	86
PID 780 wrote to memory of 1620	780	chrome.exe	86
PID 780 wrote to memory of 2080	780	chrome.exe	87
PID 780 wrote to memory of 2080	780	chrome.exe	87
PID 780 wrote to memory of 3088	780	chrome.exe	90
PID 780 wrote to memory of 3088	780	chrome.exe	90
PID 780 wrote to memory of 1868	780	chrome.exe	91
PID 780 wrote to memory of 1868	780	chrome.exe	91
PID 780 wrote to memory of 5404	780	chrome.exe	92
PID 780 wrote to memory of 5404	780	chrome.exe	92
PID 780 wrote to memory of 1088	780	chrome.exe	93
PID 780 wrote to memory of 1088	780	chrome.exe	93
PID 780 wrote to memory of 5564	780	chrome.exe	94
PID 780 wrote to memory of 5668	780	chrome.exe	96
PID 780 wrote to memory of 5668	780	chrome.exe	96
PID 780 wrote to memory of 5136	780	chrome.exe	97
PID 780 wrote to memory of 5136	780	chrome.exe	97
PID 780 wrote to memory of 5796	780	chrome.exe	98
PID 780 wrote to memory of 436	780	chrome.exe	101
PID 780 wrote to memory of 5140	780	chrome.exe	102
PID 780 wrote to memory of 5200	780	chrome.exe	103

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\overrides\mods\Xaerominimap2.0.jar
1⤵
PID:2708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a39ec728,0x7ff9a39ec734,0x7ff9a39ec740
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,17185753903894052232,9415976443952150886,262144 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,14899050375306591850,4892042497869184662,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,18001504429871668071,13235686320775236394,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,8316025041650310306,9680110317513953862,2097152 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3444,i,5287870337453916524,7443570988204675810,2097152 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,16870901344728138551,16403948404642439583,2097152 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,11300940909758275239,4874284550270723298,2097152 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,1121994500726755927,6038556560147480132,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,12302419660379274488,9580223735635441802,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,9879586848165160093,7940876168905853606,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4936,i,2691920260544399106,9608493304041985915,2097152 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3652,i,13011867971926016391,9611512641390282508,2097152 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,9535507906699850000,5011218438795709864,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,13532407142535911454,17678776902216755551,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,16781041665752354787,12310060114946525737,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,13973225502406961710,1299340784826723113,524288 --field-trial-handle=1904,i,6751480114209128424,10400426601877974819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:5200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3192

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\RubyCraftSMP-Mods.jar"
1⤵
PID:5992

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\RubyCraftSMP-Mods.jar"
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9f268324ac300f39b7964472f397a26a46f3f74d160385a700ec7a375cff5bb3
MD5 6c651567ba46f0558107e6c59b903e2a
SHA1 c504a14e8d97c35e48937bf4030bb2497dd82687
SHA512 8a0674e85ea064b8e5daed372b3bd19cc218885f21c7754cbe5ed315e584e43029a4feb4d7144a79767e4140336989c843fe557deaa83252b635701b410c31a1
TLSH
T15BE02BBACD51DC3F2DFD175850244745D60013073B41494B373D920C8FB5A376992C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 af85ed82cd7c17410a6c960a981776f2b4693c2811782a2df185887d3f17f302
MD5 a0639f764e6106eaa928e2ea7041b8b0
SHA1 8f209b3d2f2198eefc8c456c2348b17fda5d96d3
SHA512 fae0ec87fba85c5c24d92efcb7620591da63b06005428b9f5de298691b65a6f9a0d0cd6d2895d381a1c9dd060dbbc1d718f5921d8833e133d8b1d890b9a9ba2b
TLSH
T1ADF02241EDC30221CF70AA349A8F380C63D527B78802E31E418C8CF829272F354694F6
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4295b0198827397efa6fc753c4a0603687cc27c09919ac121e959735af924982
MD5 cbc792f10601d7b083c3067eca1fb164
SHA1 035303aa7d67901c8ea5d1ba77a87a5e250c082f
SHA512 a32360d17fcf2f5ce87642533b994a89f461279c1da6570c7c4e215104036b452ce6272bba78849ca072e6ba6b0ac00ff71c2c2e9ee6dc150d87e5c2861a3735
SSDEEP 192:HRQRFcBzR0qib3v7lhAPRp2/FYp9+Hsb+WNiJ8y41r2jc+U9VyIsnAUgtaJ:mRFmzREfR8Xr0wAK2A58
TLSH
T10A52E77BED502A7B6CDBC21AFA217717D3F4102125942D84E6FC8A2C14EBDCC211B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 579669c0b4e64a1b1ce67bd553c2df91168d24d366cf3d3c0fcbf375503a5f01
MD5 f1b2aad4b528e7eed15864bd8e2beed0
SHA1 61da25d22d7f267312eb15023fe1767a8318f7fd
SHA512 cd3afab1c5589e021424f28d976e416d55dcc7efde5b2e17abb8ed3971c047edf6b0a73bebb00132d9cde41afc8dd828b78616b2c16304a9d2248f919ced1f6b
SSDEEP 192:HRQRFcBzh0qib3v7lhAPRp2wXFYi9+Hsb+WNiJ8y41r2jc+U9VyIsnAUg5aaJ:mRFmzhEfR8X/0wAK2A55L
TLSH
T15652D67BE9512A7B6CDBC21AFA617B17D3F5102125942D84EAFC8A2C14EBDCC211B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fa442feef347e8c2719ea3a371a04db74e50dff42d3189944c26f549c3c9f9a3
MD5 ca265ecd244a8ad10b31cc1f47dcbc25
SHA1 16b614913cb98c272609b33d8dd59b9406208292
SHA512 c0ef0b063f0c9780e594032dfccfd678aa65e0ca9588e6a65a27077f9ddd2398982613ff506199f3bf4bf7dbd0a7870f2b547f42bfe2dd5543962fa2fd44e23d
TLSH
T199B01200C0016101C08206B0318218CC71147F249A0E2F0143F06D33C8395B38414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e5e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590e5e.TMP
Size 96B
SHA256 5397e12b0c5bbde5e72017b09ce07e6250fc85b4ff4091d2bd01d8f0ed317648
MD5 05a55c336f7f4e00c65b734a03ef8d4a
SHA1 c16dd450d3044a8ac9f65c3fd7039fc38f7af7fc
SHA512 c71b26c55ac0defb63adcf994420a75e81bdd3f16d4536b0ea3626c0bbba58e2ae2c91c9651c466e2f00df77fadd2e5eb5fc911f49798676e7b756d5a6a5a7f5
TLSH
T1BDB00255D103B217C44313B165D695DCF160DF35C603121292E02A77DD397F2452A571
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 65e8b30099d6858c3a496d04ea339b8593278300d6f555d1b7db804b7bc63096
MD5 eb122339799c5e6eaef0fc86da8b91b4
SHA1 286a37627833a2d1066820c351fffc2bb627ab06
SHA512 49b701374d4d53eb9b6de4f82f28b7beee38c7d806a92e11c211610c7bb14136a0b13586f55dc33dbf00c88eb4ef9a4bc9d87d9d9801e28dfd94be02a8ab7afc
SSDEEP 3072:eslYHDKM5/fjFhRNUH4WiB6wxLeb8Saq/OVGm7D5Lk17ox1tIpud63U8BehbCBiv:esl36/bRiH4Ywqm7Rkm1tYpBeh2BAou
TLSH
T1773413375D34A8765ABD371AB0CD462F4DF70E61991AEC4AF9C4790026EA7CE1E06D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2832c9e92a5c8d8337ff14ceb4eb0bac2ef839eabafe9b3f211535294c764bb4
MD5 38acd0f73bf16b7ca035bd074684ae18
SHA1 744a89f13d74517efc69237e0110f6b6037153c4
SHA512 9f31c0be25c5597fcdf92842cf0886fbeb92d013115f0accd4d6ad29250e1a05e27430e44ae05bccee1c6c698d42778f5186eba8d26df9a99312c4b0c15e4b09
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:gm7Rkm1tYpBeh2BAoa
TLSH
T1E3C312375E71A9775979BB4EB08E0B1F1EF149A2D920DE42C8D85B0427F97CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 bc94b584b25fb4cf96ca5e931552b2796c893ae263c15376f867b8631b5b258f
MD5 264c98adec4814596b8b97daecc680db
SHA1 7a5e1807142f45e48d0818d2b9d8656cb3c8a1fa
SHA512 2ff6022515022c581e43b2bef460302e4a9aed4cfc0f032231b89d298d9f08493b997409d4f807fc2f11e0a348bddd26450336646e03df7e5860252d56ea6760
SSDEEP 3072:TslYHDKM5/fjFhRNUH4WiB6wxLeb8Saq/OVGm7D5Lk17ox1tIpud63U8BehbCBiv:Tsl36/bRiH4Ywqm7Rkm1tYpBeh2BAou
TLSH
T1803413376D34A8765ABD371AB0CD462F4DF70E61991AEC4AF9C4790026EA7CE1E06D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RubyCraftSMP-Mods.jar:Zone.Identifier

Path C:\Users\Admin\Downloads\RubyCraftSMP-Mods.jar:Zone.Identifier
Size 180B
SHA256 2a5b8770cdd64c8210c225979376861a6868214cbb69e501b1d64558a185d948
MD5 72143aa927fbeee9915e6e3d28c446b5
SHA1 607d6273be511f4645cb4bb0e36c036595e3e800
SHA512 a778a82edcd79d53cd8dcf8f07a3d5bf7bcf2b259d6bd9d92939a77b6eb0bfdf870244e91d34f330d9e789e3bc26d8d7a063d9034373f45c016448411daa548c
TLSH
T10DC012DBC03BD924052CD08C9ABFD244700B32548E618680E451009FAAC002FE99D407
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 865009.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 865009.crdownload
Size 4.3MB
SHA256 1803b850f10bc543cef04c831bbfcee6447fcc0f5dff858ed9f0f1fb77ce34e9
MD5 d1c40dfa7c03daa756c8b40f3c512cbe
SHA1 cb2982e8a86ebeaa10081708929f2cce6181f57a
SHA512 cd0a4565b5ad2d20ea9ae99af1662f519c275f07d5ab142f9c009139fac125e4cc82b257a9227842d617c676c7438c001b1f8b934b68e2020238b2bb272c798c
SSDEEP 98304:ArXze7EtEeHkuw7cziERdLhJbNe9ZKgVLhrlu2phhvZlh4S+6MkVyV0wxNuM0fF:ArXze4W2kuw7czVRdhtNaMiLCwrh44Tn
TLSH
T1312633EFE8096B032E4405F7D0977197AAD4F14740E752930DBE22B96A2FE02787CD96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2708-12-0x0000024ECD100000-0x0000024ECD370000-memory.dmp

Download

memory/2708-11-0x0000024ECD0E0000-0x0000024ECD0E1000-memory.dmp

Download

memory/2708-2-0x0000024ECD100000-0x0000024ECD370000-memory.dmp

Download

memory/3476-192-0x0000022FB4AE0000-0x0000022FB4AE1000-memory.dmp

Download

memory/5992-167-0x0000025AB79B0000-0x0000025AB79B1000-memory.dmp

Download