hxxp://mconnect[.]metrobankcard[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
896s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mconnect.metrobankcard.com
Sample260702-pgdnlsgt8k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274682791368803"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
876	chrome.exe
876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4772	3012	chrome.exe	86
PID 3012 wrote to memory of 4984	3012	chrome.exe	87
PID 3012 wrote to memory of 4984	3012	chrome.exe	87
PID 3012 wrote to memory of 4136	3012	chrome.exe	88
PID 3012 wrote to memory of 4776	3012	chrome.exe	89
PID 3012 wrote to memory of 4776	3012	chrome.exe	89
PID 3012 wrote to memory of 1828	3012	chrome.exe	91
PID 3012 wrote to memory of 2032	3012	chrome.exe	92
PID 3012 wrote to memory of 1828	3012	chrome.exe	91
PID 3012 wrote to memory of 2032	3012	chrome.exe	92
PID 3012 wrote to memory of 1276	3012	chrome.exe	93
PID 3012 wrote to memory of 1276	3012	chrome.exe	93
PID 3012 wrote to memory of 4196	3012	chrome.exe	94
PID 3012 wrote to memory of 4196	3012	chrome.exe	94
PID 3012 wrote to memory of 4832	3012	chrome.exe	97
PID 3012 wrote to memory of 764	3012	chrome.exe	103
PID 3012 wrote to memory of 764	3012	chrome.exe	103
PID 3012 wrote to memory of 4220	3012	chrome.exe	110
PID 3012 wrote to memory of 820	3012	chrome.exe	111
PID 3012 wrote to memory of 5028	3012	chrome.exe	112
PID 3012 wrote to memory of 2444	3012	chrome.exe	115
PID 3012 wrote to memory of 2444	3012	chrome.exe	115
PID 3012 wrote to memory of 876	3012	chrome.exe	116
PID 3012 wrote to memory of 4700	3012	chrome.exe	117
PID 3012 wrote to memory of 4700	3012	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mconnect.metrobankcard.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffaa4dc728,0x7fffaa4dc734,0x7fffaa4dc740
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,4040233237293975266,17018592320478801494,262144 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,7723047226172861014,7046026188116659193,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,17692995075414493854,11791043524913857889,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,13024801060153710738,583097606281715527,2097152 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,12779916048397286422,8623296614995444574,2097152 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3796,i,6825417977181028911,8006759746927045157,2097152 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,237953916500871508,2958975159908890749,2097152 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,3457307924656891416,4477734590194557743,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5612,i,18379184681967009239,15243696308354718342,2097152 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,1044412276602186939,4589614633981406357,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,6189561157108269535,8526537750086241770,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,4292383562650691467,2163836774115522126,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5188,i,17459664522664158101,6713608131138832760,2097152 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5356,i,8355775351154503066,18033189693109618231,262144 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1712,i,11806096778892533308,3586252935124052344,524288 --field-trial-handle=1900,i,13281778412323523274,14172292271164289116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 de537a89cc090bc56c3bab18656fa1675cad57dfd695958e3884c2ad8663e4c4
MD5 7619456a23f6f28f7c7294393b587da8
SHA1 8741727aee9e7de81b24bac08e17888b98949aa6
SHA512 423e5fd231bd6a5d29e1907c4b3e0d9c42a83c6902b7b5b95262d967e4f4be4b3492b2d83e5c77d02f146e0a6e76a37dac637f907ab5ef818cbdff25bcf624ae
TLSH
T1A4E02B65CA23EC3B18F8171864768746EA51132B6740984F373D450C8FB477B4686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 7ef9aa95d745a4896face8c96764cd6700da56edaf6344e20ad680454add0b62
MD5 445c6a371b2a17fc06ef11e2fe552d4a
SHA1 223dc0837c552e1768095a12d4a482b46a3fbad6
SHA512 3b2031c749e382778548924f55511506fab9041ae2a8b52af31c593fac49a981bd98a9883e3748c187d3d569778a2fb7f8fbc702d6280e3c41b781d80a0d41a3
TLSH
T1DFC08C2037E120C0FF642330E8598A9FA3500E1C09AAEBA24242B60859ABEDA6A0B400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 708decfe5ea9e446a81094c04bd14dad2df0227ffce25711333f029da2d476cf
MD5 403483fd2cc8b5ee391c36b4e407e02e
SHA1 83a092ca672e988ac9a36153e6600bc3f2a9598c
SHA512 61f8bc2f313f8009930ca2afd1a9331f942aefcdf03dfa1036eb85567a37b3e8571dacc0940664beae038c4ccaea27636ae15214150f3caa2da1a84352d349fb
TLSH
T107C08C3023E11285EF54AA30A8D18A8E53500F380DBA2FA36A43E80D59EB9E62607400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 530b73bbd21b7e8ac8044d096333c6190017437dad709fc98033ebd7d654b65b
MD5 2a286761e0b403fa8aa9b1687e42fa9b
SHA1 98bfe85371b4b7def2720369c2f176a6b30ec9a3
SHA512 cadcabd24edf066cdd0541e444dba87531b3ed1394b040b46e88c5a2d007059c44e7fbdbf1f5cb86b5fe0243423b7e391fb1760fdb9fa76c03a7855fe2959cef
TLSH
T1C3C0122463C444C0CFC921338AD78EE613240F2E1D7D57978D91406CB4FF9F5A74A510
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a9bd4bc898ed54c8142a403885003221c39d9af29279b65d1750d45520e1cbde
MD5 bdfa8dabc227ffbe347bea4f22ef6245
SHA1 19d12b168b563426573552b5015b8601e4f4157c
SHA512 8b07b9e32599e30871a682b63613ab7258e20e5f311e7c0d33733943a5ebf9eb1f3e042209ae4dfa4be2aff07a3ade88ffcd57fa953390eca16a56a5ff33aa89
TLSH
T1ED518AF783A49A7DCA0192F4AB146E1FCE6D0924435D3C66C8E4AE1B83F2972D14124F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2579d6ae8e2dcdf85692b3c55e2e485a98fff131b228ba4f885257886b3c1fe7
MD5 bcd4fbb83b473edbf1a169703f7bf48d
SHA1 26165ddc1604066901dfd3df0d9602ffa92ea83a
SHA512 5d8ca1c6be618f68af2fcf8ac71f298600b43490c5948240c3f2909d27de03a020e1d29cb648993ea921e730b048413e694f57489ed23ca22c5d79f2637ca90d
TLSH
T1CE518AF783E49A7DCA1192F4AB156E1BCE6D0924436D3C6688E46E1B93F2872D14068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6bf30e3353e8aeba725b66442f061a0a89505cdd3fece78e350e1434decd0a70
MD5 f03450001f499cd8fdcdfeb028392c40
SHA1 517c18829048b25b1f07847d9d233801ff657dc8
SHA512 3cabf1fad6ea7ad9ff2d5224def9e61a947c5edc0eb68fff102dda159c0c8ee4eaa296a84f80751397b2f9ea9b3ca1c996b81d6a81b19bc75ad6d2d4865101d4
TLSH
T1F8518BF783A49A7DCA0192F4AB156E1BCE6D0924436C3C66C8E46E1B93F2972D14168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0acae9e9dc111cb0d058362acd4cf5a3e123d70efa3db8ad7b44fd6013152305
MD5 a40df030ef4b169b8605a1cff0ab455b
SHA1 c513311cec010af17c9fdeafa20fd6d1668e2168
SHA512 b17c0eddacf30f9e596464553f3b551cfee1caf5e40952aa8c0d1ac148274dfb604592e1785f62dd95bb1257f5044eef623d53d55d4f12c28ef32b2f2343d5ef
TLSH
T1BB517AF783A49A7DCA0192F4AB146E1FCE7D0924035C3C66C9E46E1B83F2972D14168F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 a015f98825173b4746221e0b20e4e24c5922903d7e4a93205fcb7a0714fd8dca
MD5 9ecc708dcd910eac8262f2ece9c72381
SHA1 e57f43819dd2455bfd6d5f228b62b43e2c6dacea
SHA512 429a7275d65f6b5ae6575d788b9c373daa06024eee1c0f1c9ee20d71ca29308421a2d735ccca0c5efb1704a24e9bc0cd3a5c45753e0d63ad9e3c73fe3eac3065
TLSH
T16A1188F7927EB427407A89BB0E44BC0615B9B476425268E8CF66823CF0C25E31F1A466
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8b44642a6f5a660500cdf4e7ee8296a67ac15d10acbe6b2cdba439f5e2587389
MD5 904f359901955040b6399bf7aa286591
SHA1 6277b81569d589e98c5903085dc7a721674b5b51
SHA512 4fb0b0432ae3c1ce9d78f73a4259ce6064384b429fcb3b09825e0f3a19a7cee4a2ae14592740080346e26883d194ff09e3f9295d8f2446db92d81351cba5d0b8
SSDEEP 192:FRbFDNs4DICVv7MF+pAPRp2Uf9HHsb+WNnmFJWD2XF8fkwbfVyIsnAUge:FRbFCWlgoUXt1wg22mfte
TLSH
T19642C86EEE21297B6CCBC21AFD567B53E7F5102261D41E84E6FD891C05E76CC2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fef39b5240ba1302b84d3185cf64a91ae01631df1e21cc3ba32e22c8031f673a
MD5 7b57d3dbe94999194ca26f0cb5aa371b
SHA1 95fdbe800f569c07f49609620d3eb2a5d7dfc904
SHA512 7248fa08c2b87c663f35ab432d61f0544c10fafdc9fb936a0d959d6e0fea32578cc8efda27f413b05becc95648d2aa872f95fc2d8caa742da9704b0dcfe9d144
SSDEEP 192:FRbG8SOkIqDNs4DICYv7MF+p2PRpIUM9HHsb+WNnmFJY5e4VF8fkwbk+VyIsnAU3:FRbGlCWEgoaXg1wgae4Ef5E
TLSH
T1D162D72FA91469779CC7D22DFA66BF63E3F5102226841D449AFD861C05F7ADC2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 639bf0ebbf45761fb0fc2c74d422c7a12576fe90b650bfd61f95e729ac52fe60
MD5 f90aced9a9e4a0af860ce579d6095eb1
SHA1 b2a838dc28027c00cc0b81799b108dcfa63d4bfd
SHA512 4b2a5f81906ab2903cac3d9347f61b61979bda23d7330f1376d50cb114066f213069ced0a02049bf785594e2254c1430a23932c5340e1f467cc3505a5681d110
SSDEEP 192:FRbG8STJSDNs4DICyv7MF+p2PRpIUK9HHsb+WNnmFJY5e4VF8fkwbk+VyIsnAUgE:FRbGeCWegoaXG1wgae4Ef5E
TLSH
T10E62D81FA9246DB7ADCAC22DFA667F63E3F5102222841D98D6FD861C05E76DC2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 ffd9e106a5a235d7dbdf60e34324823009da00ea73ad82d781377e6f91e48864
MD5 a4d6feb5798116db8dc6f457d4d47a17
SHA1 d1c924ea8d4739865147d9d20911df6e4b052029
SHA512 e87e05b73c5eb470845e4ee361468fa5fd4e4849c0ab5e1a232bfd8c656080dbacf9a4564f7bf07d2d1a289412049119324da151ab918243c369c6bb549c3678
SSDEEP 192:FRbG8SOkISDNs4DICYv7MF+p2PRpIUK9HHsb+WNnmFJY5e4VF8fkwbk+VyIsnAU3:FRbGnCWEgoaXG1wgae4Ef5E
TLSH
T1B962D72FA9146977ACD7D22DFA66BF63E3F5102322841D44A6FD8A1C05F7ADC2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 26c69ac814b0a0790fc84768abc6ba95aaa4e5fc544d7e7d07fa44890bf138cd
MD5 a2ab04d719e0febdf4647c04f98d5190
SHA1 c136affc4ed64d6116bae7525acf2ca34ed40592
SHA512 ca6a11b3d8cc4bf11c135948b4f520a02a517015d53f6a4ef299ded06dc56197d9950f245843e795fcd1bd2ddc5c4d0671f7609f36688c4bbc8d090cc0d358e1
SSDEEP 192:FRbG8S5DNs4DIC7v7MF+pAPRp2Uf9HHsb+WNnmFJY5e5F8fkwbfVyIsnAUge:FRbGLCWDgoUXt1wgaeYfte
TLSH
T1A452C72EAD2469779CD7C22AFE66BF23E7F6102225841D44EAFD891C05E76DC3213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 6ce6ed0537eb7d60d8c5312406af9f0709eb868d3710dc198d013ad0823600f2
MD5 67e9aeb170a5e17219385858a1b3502a
SHA1 7ae62ed958f5d41bc7625bc7fac56bc6e17cd645
SHA512 6da6c4cfd7ecf57ca1a86160396f22b15c73edef6c1715f6a8f259ffcd7ccbb45c840d91c924744f6cef0e608124ca8bcd2f7ee4dd1e4a020041621236e7597f
SSDEEP 192:FRbG8STJSrNs4DICov7MF+p2PRpIUK9HHsb+WNnmFJY5e4VF8fkwbk+VyIsnAUgE:FRbGeqW0goaXG1wgae4Ef5E
TLSH
T12662D71FA9246D77ADCAC22DFA667F63E3F5102322841D98D6FD861C05E76DC2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6cf8d1623138667d83cf2ce0f74c24b00308d609bc399d79b59209a9cd2263cc
MD5 f9dadb159712c4cf4b12aa71958a9fa4
SHA1 caa38e9b66ef43dbd874e33ab7da080336f97243
SHA512 37b71ab121c6908b313c75e5a7095fc0e373374988218f4399261511ff89f6b9f7b67e978965195c46f9ab89d4e9728e4fe0a2180857096cb215f78d0dc2ca79
TLSH
T1FCB0120280015101C48602F0155614C8F1946F109A0E1B0143E06922D8251A18015052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b234.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b234.TMP
Size 96B
SHA256 84165c963d0020c2eb5952d2e1d52754724d0e620a0cff20a947ee1f62e940d0
MD5 ebf73b7a7d7f2b3867d74e2fa7561000
SHA1 315d9e7e0ee54ac770c2a2587230008427bebda2
SHA512 74c4e2fe6919794302bd2c7656294b9fd0baa94566d95b27568a88d9c44e2614825d40be4f9e072b00124670e2b3079778441db8be0f0f27924bc610964266dd
TLSH
T1A5B0223CC0022202C08303B0208CA2C830A0CF30C203032283E00EAAECF22B00038220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 493da4c9b917388092100ffc5381a5c163ac7598c2554e072b461aec8667b09a
MD5 3c1f8fc1272b0b0bdd9aecd8ce6bf554
SHA1 a46a40dc3b7c1f5441d97eca9b110a14fea2d599
SHA512 15fe6fca2f7bf6d16cb9bbc8fc6bab36ffe8cba30d35ebf3585762a0f39a759e808b3c7ce20896c37c04d7fd5a19768c5b5964eadf91c83ba320f35e4b54d783
SSDEEP 3072:MzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:MKm7Rkm1tYpBeh2BAoM
TLSH
T15CC312275D75A83759B9B71EB08E0B1F1EF149A7D820DA91C8D85B0423FA7CC1A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 99d23bfd28e7810936bcbe1b0d23b87d4ac3ad4c05a1183ac7453528d7815317
MD5 9895a6b47157c10ccea42f3f75743285
SHA1 827b267d96ec429ce9aedb7f69c5d7308636954e
SHA512 f0865b72816bda4ae1c3155a765c9887aadee8c0e5ee460bb8424a4e7c988c5fafb188c0375801fe2576c744b616a67339090851b70f596d5d865812d5c10f65
SSDEEP 3072:ngGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:nLm7Rkm1tYpBeh2BAoM
TLSH
T1CEC302375D75A83759B9FB0EB08E0A1F1EF24A67C920DA52C8D85B0423FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e7190f397581f77630ce2479b02d4fb9527abd603a65ff43c79420f18e2352c9
MD5 512e7b6479c631c57a3896fa9423046a
SHA1 75b6898a7139d98036ca94a1d7f40d2e5bba9676
SHA512 97c7cd173c0de6275799b798cc27c1342599167db8f49010c674700e5fea1799011a89a2440472abd65a6cf33752257028e218c80f17e0ef6329ef93aca9e478
SSDEEP 3072:XEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Xnm7Rkm1tYpBeh2BAoM
TLSH
T123C3023B5D75A83759B9BB0EB08E0A1F1EF24A67D930DA52C8D85B0423FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 6a90ea2018ed3f945e17bcea527413e965a1f964f4fcb5d9f1c29a06d750e92b
MD5 461b01d521342817d6d1572e7fa8203d
SHA1 2569cfd92b8506c87b911a694919ab292aebeacc
SHA512 734e5b2c3289114bd9761a382cc7963de4f724b6c3f7b3b191819ad77fb39e1235352f5d8bdecc2479978de33340abc3765118d27ee0a78f1b88cf08a2533a4b
SSDEEP 3072:XgGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:XLm7Rkm1tYpBeh2BAoM
TLSH
T133C3023B5D75A83759B9BB0EB08E0A1F1EF24A67D930DA52C8D85B0423F97CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bc23a939e10193f5189aa6e8e1ca9c39706ad3337452a2e05ddad75e90438e3c
MD5 1db824b2f42402f3b08a477de015b3df
SHA1 aaf39c04f315e6b8782a2ef6c9324307bad687f7
SHA512 1ae11ba156c76fdbf9712d950c819730cdad0d4be78ac3bd1f65ea42044ffaa00a556faeb3dbf45ba82387ef825208985004873c3b76849b7818330a8e410d62
SSDEEP 3072:XaGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:X9m7Rkm1tYpBeh2BAoM
TLSH
T145C3122B5D75AC3759B9BB1EB08E0B1F1EF149A7C820DA91C8D85B0423FA7CC1A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a394f51657fae1c965721384eea493236b7b02477c1a0272b09a787f12292e14
MD5 b9b108859e0622ea616b601a764ef91b
SHA1 54bfdb307a184a44a09e9ad86d9e528e635639b1
SHA512 7aef3eaf4aceafa0823c42b76952365a75e573348bfc7ccd526f2e1aba6bff8f6522c05b33a22eaa6b35103ce85bc1bd2fdacef89a2efcf8229b8f4dcb51c050
SSDEEP 3072:/NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Em7Rkm1tYpBeh2BAoM
TLSH
T147C312275E75E9375879BB0EB08E0B1F1EF14AA6C830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download