hxxps://pl[.]exloader[.]net/

Analysis

max time kernel
600s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pl.exloader.net/
Sample260627-stxtssb13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270482762639409"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
3168	chrome.exe
3168	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe
Token: SeShutdownPrivilege	4156	chrome.exe
Token: SeCreatePagefilePrivilege	4156	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 2452	4156	chrome.exe	84
PID 4156 wrote to memory of 4000	4156	chrome.exe	85
PID 4156 wrote to memory of 2120	4156	chrome.exe	86
PID 4156 wrote to memory of 2120	4156	chrome.exe	86
PID 4156 wrote to memory of 2224	4156	chrome.exe	87
PID 4156 wrote to memory of 2224	4156	chrome.exe	87
PID 4156 wrote to memory of 2264	4156	chrome.exe	88
PID 4156 wrote to memory of 2264	4156	chrome.exe	88
PID 4156 wrote to memory of 3728	4156	chrome.exe	89
PID 4156 wrote to memory of 3728	4156	chrome.exe	89
PID 4156 wrote to memory of 992	4156	chrome.exe	90
PID 4156 wrote to memory of 992	4156	chrome.exe	90
PID 4156 wrote to memory of 736	4156	chrome.exe	92
PID 4156 wrote to memory of 736	4156	chrome.exe	92
PID 4156 wrote to memory of 4672	4156	chrome.exe	93
PID 4156 wrote to memory of 4672	4156	chrome.exe	93
PID 4156 wrote to memory of 3076	4156	chrome.exe	94
PID 4156 wrote to memory of 3076	4156	chrome.exe	94
PID 4156 wrote to memory of 1896	4156	chrome.exe	95
PID 4156 wrote to memory of 4412	4156	chrome.exe	106
PID 4156 wrote to memory of 2780	4156	chrome.exe	107
PID 4156 wrote to memory of 2084	4156	chrome.exe	108
PID 4156 wrote to memory of 3168	4156	chrome.exe	110
PID 4156 wrote to memory of 2552	4156	chrome.exe	111
PID 4156 wrote to memory of 2552	4156	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pl.exloader.net/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd06f1c728,0x7ffd06f1c734,0x7ffd06f1c740
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,1023759378165958808,18436268078273944036,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,11699062462686501450,2397983667244994472,262144 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,13274057933811234558,8626896302436575306,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,17031341308183262734,16782144180199156111,2097152 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,12612237071629699332,6135419451616059091,2097152 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,10506985553331079974,7625368883651601226,2097152 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,13965843861268012688,1113042233392966127,2097152 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4932,i,18025035304358470713,2192924320795169591,2097152 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5116,i,2120137057397241790,17514126619308695218,2097152 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,8363301680327372039,11908137831581461911,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,11306281029632090356,16971076154775105884,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,1353036693700548581,5964553419603531,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,15079150389960625349,1216426313322523811,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4404,i,16036742639937169273,4605800942989610105,262144 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1136,i,7349767285683562570,10056515329657106296,524288 --field-trial-handle=2072,i,9412695507238440607,15177411264117613302,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:2552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

42aab069-d5ad-4668-996d-7b9c4767fb7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\42aab069-d5ad-4668-996d-7b9c4767fb7f.tmp
Size 12KB
SHA256 068e9ae82434c15d3df13190824a8cb036e76d00e1da21ff802c31e0948af2cd
MD5 5f403136e5e14230b6ac925306445c0b
SHA1 e6bb13c408aa1b57621bb34d08187fcc17216b8b
SHA512 62d99d682dcc9bae2f19b59ce520dfc9e1c40548543c4310344bea416f34fe2e6a757cce0d78cb75ada4f261d71f92a6c722ebfd30da1b528aff625c474eaa7b
SSDEEP 192:KR1sv8/MJaVq1v7spAPRp22MY9wHsb+WNnLvZbXE2ykb3270ekzaNFVyIsnAUgE:KR1sv80JFFYUX/JKwFQ27b32SahE
TLSH
T1FD42C72EFD24A83B6CDAD22AFA277753D7F5102121C01E94E6FC8A2C46D75CD226741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 88b2bb3d4882757d78566be50e86472c7e05faa27d9ede56b81518b618bf204c
MD5 6475312f5e3874a13ed9f589c8d51280
SHA1 41d2d41a91f66b73fe0f227f54e3c8dd08c13b71
SHA512 1733a2030e1f2da0949aaea6e62b4d30c1dd974d3194ef106651d0cce062442d010339d956ac12412480bfbbf8d47672aec2c0ecd579140e2c860ad25c82e5d0
TLSH
T160E02B6ECC22AC2708FF471DA0150649E750175B2F80954F363D620CCFB062A51C6C7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 e7ca3e7c1928c61e626a24868c7179d40d7eb091cd4caf27b3821df91700e6f0
MD5 0124e528468d0a86e1c3eab37e96197e
SHA1 8d7898f733610843c78084dc7a8ce6073324fa10
SHA512 2a5999f8f85ac1972abcd71559b77346e0b9a0e6a2257c77a7c671d77c5370a9cfe9e4b2152516cdc7a7b43dcc9554289752e99a84f8d8d596912faa56f24b03
TLSH
T145F022153AC208A1CFCBAE71AC84DCC0EF356828059F1FFB42610AB85F672C51111241
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fbf199ccd0ef843c0dba82b4a31822fb8a7e3c87b63337b6d617bb46db4b41f5
MD5 025e894162fefaf7c2742ec7c9b58f91
SHA1 81b2d5e359afde73297914ca70d331f83f134e2c
SHA512 89da7ed6be84e3f1fd8b2453caee9132b1539aaba2506d5904ac3ff9113a63a6dbc8240f5c9199add6f555bfdc060672c6b210541f711d1ea662d4b46cb09cec
SSDEEP 192:DnJOUJiJgJwqaaIEdLZitM1QrFqX9ZVS2axPi+Pi8quPjjhis1K:DJOwiJgJwqaaIEdLZitM1QrMX9ZVS2ac
TLSH
T1B1D19CF793F8962E8D2191F2BA252E1FCD2D0924036C7D6A89D49E06E3E1971F18154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6fd3e4738a9e7b1e02f522840e8ff9f0e6a18c9121c5e3218f2cc2a0bee9b4a3
MD5 578e9977c6eeccbf60f5875242b664d5
SHA1 5661c541db811b5db6dd87579fee02f0beec4b6a
SHA512 e4b32a5acc4f7af1ae6184abe16894e5df982ada85601e46cbede21e1fd630c5621ad7cd8d7871d266d30f553cd09102596aa7d787d87eb3dd25974f6df56625
SSDEEP 192:DaJVzuJzJpJvqaaIEdLZitM1QyFqX9ZVb2axPY+PY84uPjjhiJK:DyVzWzJpJvqaaIEdLZitM1QyMX9ZVb22
TLSH
T1A9E19DF783E8962D8D2152F6BA252E2FCD2D0924436C3D6A89D4DF0AE3E1971F24154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2c5235d5917693c345c76461f2d1e6491ff6875ac27ef4febaf4aa45738817e1
MD5 79aaa422919dc2ec18a94620ec7e3a95
SHA1 32f5d62cdba73f56a1a19ca00af127164a1143ab
SHA512 38454a2c762dd9fcdae4bad05f123917dbcf62f74d9e974809ee87ca72d53bf542b9324e6d6e430a1b6011329a48c396912b23d870715ad312afe42291dfd157
SSDEEP 192:DaJVzuJzJpJTaaIEdLZitM1QyFqX9ZVb2axPY+PY84uPnSjhq:DyVzWzJpJTaaIEdLZitM1QyMX9ZVb2a3
TLSH
T1E6D19DF783E8962E8D2151F6BA252E2FCD2D0924436C3D6A89D4DF0AE3E1971F24154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abfdb25f-aeea-4c2f-91aa-06c8dff1ebf7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\abfdb25f-aeea-4c2f-91aa-06c8dff1ebf7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 000344ca4ce8ab1066f842ee248d229f423d5515650e6e16334bea2b703ab92d
MD5 b7dec8e9d2e8b5fe30db1834dba867b6
SHA1 a22524ccfe4761293237b51b48254b036d41055f
SHA512 43b046352a1bddebfe0527307a9ddba16823ec02557e34e6a10b9d2101644f8bd645a962235e0417464f9b2dacdc305d5bdd3f6c881162a4d4093114d2389d39
SSDEEP 192:KR1svHMJaVq1v7spAPRp22MY9wHsb+WNnLvZbXE20kb3270ekzaNBVyIsnAUge:KR1svsJFFYUX/JKwFQ29b32Sa1e
TLSH
T1E942D72EFD24A83B5CDBD22AFA267753D7F5002121C01EA4EAFC8A2C45D75CC226741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c98562c85deed51ea6974c6ae34934bd17851df768fdfe8c67ec043a922d62e1
MD5 61e3c1e5d27266c22a0a9a927525641c
SHA1 baca19bfe255206069ab76944eca0a4947bb77a0
SHA512 adecd07a793a0cf729247069e2434fe1bc2fab6e60cbf82980c377bef47190e5754ef217d3e0a0c234931f45cdb1e9955ff503118edc9c2e7f5477305dcd08c7
TLSH
T113B01240C0415101C00213F811421CC8B1549F10A70E1B0143E0AA729D252E0C114170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5890b2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5890b2.TMP
Size 96B
SHA256 f584deff2a1920902cf99bbeab0c5d6cef0b84d001f6799b0563ec178a46f29e
MD5 3c226ae9758e25c74bc41034d745fdaa
SHA1 a78483794d8b177ae1e694bb90608851931787c4
SHA512 702ba79f65143228b25fc3425238d4b4ef29f6866881e48c5488bf3f5f0093815caa7d18a597298d1cd3a8131c78871f5509a30c12811f590439931bf473bc9b
TLSH
T1A8B02200C0023303C00203F028A88ACAB232EF20C2030202CAE00A2FEE202200020030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 5779eef020f1af95242dda0db073dbab295ba96b7091444c61a74a11f15dab91
MD5 b0deaf8341ac5269de7842890574d943
SHA1 f8cac23961f495172470f69b6452d8d0e76818ed
SHA512 64d67cc552e177c2aa0f24479b5da19d6647b8639800ad5abeaab1ad43aae9d238e90f03576878a6893bb0ff66cae2373c8787e104b7826dc18e71a9d3066013
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:zm7Rkm1tYpBeh2BAoK
TLSH
T19BC3023B5D75E83759BABB1EB08E0A1F1EF149A6C920DD56C8D85B0433FA6CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4aed241c84ad191804eb3d19e0043f506ebe822f32a502195da9b12e9517caab
MD5 40fffcb4b2a223d80744f12d0715f714
SHA1 502cf46e605f38b1d7a8d51f8ef5840db585d13c
SHA512 cf627bbfcaa34b3679d03d317982e678860e263cc36f1e025b7dccdda2e8dec1522b4c4138c6ba1f0220de28f3062ac83865944349e7abbf7fc272c25d5483b3
SSDEEP 3072:cGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:vm7Rkm1tYpBeh2BAoK
TLSH
T155C3023B5D75E83759BABB0EB08E0A1F1EF149A6C920DE56C8D85B0433EA6CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 88a7b15848d68a575e2f7ca1e73d49980869d20c0259442197125c92dfd8520a
MD5 4dbd3ff73803544f186178fbdf6c1fad
SHA1 c26034c53552265906068eacf30ccda797195fa0
SHA512 0d465391a6b2764299197c72275bad6642058dc1bde2832e0906a3455b19f9392b9d444e10a35146da0dcd9defaf7b3516dc09826d360abfe4c74e1164764527
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:1m7Rkm1tYpBeh2BAoK
TLSH
T1CCC3123B5D65E9779979A70EB08E0B1F1EF149A2C920DE92C8D85B0477FA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5f7374c52dd1b4f4e95bfe31cc215761368b0ac53725f7088954fc20b66a3f27
MD5 8468538941baeb8df9b1c30435e3fa49
SHA1 18af6ed398fa4fcd3fbfc7f3649c553dbafd6efc
SHA512 ce81e11a1894349cc80499e9f65ce568237899be3b6811779b36d2b11024d20d874ff098728bfbdb26fba1760a07bcf5dc448fb0ca350c0ef6d611f505c52ee6
SSDEEP 3072:gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Lm7Rkm1tYpBeh2BAoK
TLSH
T12EC3123B5D65EC3759B5BB1EB08E0B1F1EF249A6C920DE92C8D85B0423E97CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ac341fc8e3e998e758eef492a10667cebe1df4562abc6e0a71c6cfd276d888d7
MD5 24af0e6f4873d093923709d44b48db06
SHA1 9403a1edfe43b8d381f42c78682edeaf335a32be
SHA512 a89bc5bd4588f92dd27c65bb46beb658dad4554fa2d7d11c2996417e913a1dc267612b7c9a6ae7454ac46c31904128df8554416a92f8eccefa5593e67a9d43fd
SSDEEP 3072:ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Ym7Rkm1tYpBeh2BAoK
TLSH
T1CEC312375D65EC3759B5BB5EB08E0B1F1EF249A7C920DE52C8D85B0423EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download