hxxp://edm[.]postnl[.]nl

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://edm.postnl.nl
Sample260713-g2fdyaew21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2932	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283970812052881"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
452	chrome.exe
452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3328	768	chrome.exe	86
PID 768 wrote to memory of 4980	768	chrome.exe	87
PID 768 wrote to memory of 4980	768	chrome.exe	87
PID 768 wrote to memory of 2932	768	chrome.exe	88
PID 768 wrote to memory of 2540	768	chrome.exe	89
PID 768 wrote to memory of 2540	768	chrome.exe	89
PID 768 wrote to memory of 2108	768	chrome.exe	91
PID 768 wrote to memory of 2196	768	chrome.exe	92
PID 768 wrote to memory of 2108	768	chrome.exe	91
PID 768 wrote to memory of 2196	768	chrome.exe	92
PID 768 wrote to memory of 2084	768	chrome.exe	93
PID 768 wrote to memory of 2084	768	chrome.exe	93
PID 768 wrote to memory of 4380	768	chrome.exe	99
PID 768 wrote to memory of 3056	768	chrome.exe	105
PID 768 wrote to memory of 3056	768	chrome.exe	105
PID 768 wrote to memory of 4180	768	chrome.exe	106
PID 768 wrote to memory of 4180	768	chrome.exe	106
PID 768 wrote to memory of 3100	768	chrome.exe	107
PID 768 wrote to memory of 3100	768	chrome.exe	107
PID 768 wrote to memory of 4412	768	chrome.exe	110
PID 768 wrote to memory of 4436	768	chrome.exe	111
PID 768 wrote to memory of 116	768	chrome.exe	112
PID 768 wrote to memory of 2700	768	chrome.exe	113
PID 768 wrote to memory of 2700	768	chrome.exe	113
PID 768 wrote to memory of 2948	768	chrome.exe	116
PID 768 wrote to memory of 2948	768	chrome.exe	116
PID 768 wrote to memory of 452	768	chrome.exe	118
PID 768 wrote to memory of 3744	768	chrome.exe	119
PID 768 wrote to memory of 3744	768	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://edm.postnl.nl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7e0ac728,0x7fff7e0ac734,0x7fff7e0ac740
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,7488954756683977542,16793507824874208399,262144 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13358112179231421578,16436083918112578815,524288 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,551920317140914744,10462468561847281556,524288 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,4992274165337427441,4951983964328277028,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,13993001476506870233,14464091707158950751,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,15133385567131856224,17057109070916440754,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,10565693700244879279,11640737418112465833,524288 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5604,i,2672559139031789910,3233251939041745961,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3184,i,9111722103973421682,11224919784498445057,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5340,i,10767722133515357081,17799604471059700793,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,5536606772614821498,9809100976355676368,524288 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,6169913709895848795,9710895693081071606,524288 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,14938679276443275384,8261178601963062025,524288 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3448,i,9113587412360648819,2377263597892138581,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4476,i,10152959127374246145,10723591954825357601,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3076,i,9214505559858816607,10149637186040030619,262144 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3400,i,16540562737553590118,3168035009046517241,2097152 --field-trial-handle=2100,i,3616566958821993421,9217730719338137290,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0be9fa6cd6d2e12c748fc22901790d9255abd1de8b10119509377eb253902bc2
MD5 9e947933b9b5ec19ec049ad14fdfa584
SHA1 1dfea9fbd5ee8277bce2128381e5048c0cc7d8c9
SHA512 6b5d1c02a1cfb607a869787d02ebc7c15776ac5d5e998be2e8bf36d3ac6fc2052755b97883c378420d8511756145db65a88324e3f9e35764e84d7866f28e6335
TLSH
T1C2E02B9AC822EC3B1DFD5B1D54544A46DE2013572BA0885F7B3CC20CCFB46770285D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9115a61d30f3a0e0498972c91c331a83b310b073b6aa9c764e3d0c714b633c93
MD5 b898af7299e14d05ab68e2582b2d2bf1
SHA1 08553911a53a0482e7c58aaa6400d6f7fff6d2f4
SHA512 bc908ab6c694861b5d0d33be41486edc46b7b7945e35053e460598c86ad182ee9cc978746c03858995ad3318c3eacf0c3068be414e13da28056596823ab0d620
TLSH
T1E641ACF793F4857E8A1092E4EA156E1FCE690524031C3CB689D47E2B43F2872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49feff51b498b7a2f237ec5b78f50ad8865ac689a5e0b20b2222851857210654
MD5 f4020893812258f7912998e79fe86a0d
SHA1 cacc851cdb56e7c8a6e81b79052e2e2dc5214a9b
SHA512 3f9e747bf571f1a33758eb4f36537d35bcb6ed7cd3eae10924afccaf8403e0cbf17e4c45d9f6368c6d157daed85b0041326c43d979a464ae20cf1069c43644c7
SSDEEP 192:IRS0nkvw4I1mh8OdUv7ApAPRp2l9qHoJb+WNn0yP2Xkkw/a0GVyIsnAUge:IRS0+HI1uQkUXmkwdPbfaDe
TLSH
T1D442A42EED14693BADDAC22AFA157B53D7F5102561D42EC4EBFC8A1C14DB5CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aa06a94a204f62290f337a84604bc5202f7ff1cafa76030bac95459cedb5b0eb
MD5 519d99c648f0cbb88333c842cba195da
SHA1 9173aa042aa49f22995c9d32d743a72eebe73096
SHA512 f96de7c535462a99bfdc3d3f00433b9e34faca6a52727117f80a3bc2e3e93a72e8fa22afb7f5f0b520ca0043a0863167e2d127bb058028d956463867c22b871c
TLSH
T14EB0128180015541C04203B06142349871545F11D60A174543E06962C8273618415060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bbe8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bbe8.TMP
Size 96B
SHA256 f91ef941d2b300e339d59702192b8b1565c9f0f92748977b5bd446693469831c
MD5 6c3cd41e6bd1ca6a199bba6b65b08b3e
SHA1 a31056c194f6d208585b3176f45f1aaee7158280
SHA512 9597636031e744ff257f677ad627c866cc4e2ce0c632f837b26b4800a269ff02cee438ffc4608692bb9bd22cbc1995ee53618240c3f94509e64a4912f3fc847a
TLSH
T124B002A5C7926723C44613B0659999E872A0DF29D603231392E49A67DC257714576170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e081287b02452687c7ab984e81bed9d9190e8012df290789cac6b6dc8c31d3d4
MD5 0f1e3951f15b45d94b80c57cae189e97
SHA1 32bbbb26a0f12d899cd92850fbcc9177c47314df
SHA512 3f3cfd8c050743cba102f3f6441cd89431adc490e0d684e261b5bc18d96ae563f361a02ef6ef4ee41143e2b29b61ff2f230093485b0df11cae027f3d89055dde
SSDEEP 3072:F3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Ym7Rkm1tYpBeh2BAog
TLSH
T1BBC3023B9D75A83759B9BB0FB04E0A1F1EF249A7C924DE56C8D85A0433F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f61a2b26f6fbb6b2322aa6288def1c8d64204867dd8f208a52a81cdfe1b05526
MD5 ebe62efb2b4063e6ff5d87c8fcc6b4ef
SHA1 6fc91cbe89d93a7e818031b25be35174ccb61141
SHA512 476b62783f668f109e769bc416226ea50dfcad3f8e150f7c9a8cb8aaf01c3a0018f3478e26b6cb86942a60cf5bc0a95326a0f81f5706275b09ac94450da8a81e
SSDEEP 3072:AnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Nm7Rkm1tYpBeh2BAog
TLSH
T102C3023B9D75EC3B5CB5A74EB48E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d2da4c3d2c13df06806b67073149a39d79dbf65ea5ae3cdf59762432fce0daad
MD5 4f9072e3fd3f80576aca48faf9cd0ca2
SHA1 afdadc7a2140175a2019ab2b4becbd73dc071278
SHA512 d5fdc3d862e9d65cd4ce6be54c5ddb8958b7fc32c4dc1d2f3f636ee93fbe54c3152425aba48015a5f70886c0890414342def434a7fee9253fef159b5d6338140
SSDEEP 3072:OdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:nm7Rkm1tYpBeh2BAog
TLSH
T120C3023B5D64A8375DB5AB1EB08E0A1F1EF149A7C924DE92C8D85B0423E97CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 80d0d6d90de036189f906621af6f7a9caa2a99f0ac676e5fb73bfd4cb104ee09
MD5 de2eb34f09bb97236252a8002fa79b18
SHA1 f00eecec3bdb610f1fbe76b2655eb3c93b83e087
SHA512 84cfca915bb1e9c445da1e9d8159e3edead7037194ea1f4d7678b7952f256235dac27bca112e2b2dc992ac95289be1219af58d63c21bc962fba5508034344802
SSDEEP 3072:FdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:im7Rkm1tYpBeh2BAog
TLSH
T1B8C3023B5D64A8375DB5BB1EB08E0A1F1EF149A7C924DE92C8D85B0423E97CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download