hxxps://malprob[.]io/report/cbee972115b129ed3ce366217321a6f431ab86d9bf61c90ef7d224f1004a672c

Analysis

user interaction
yes
max time kernel
78s
max time network
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://malprob.io/report/cbee972115b129ed3ce366217321a6f431ab86d9bf61c90ef7d224f1004a672c
Sample260727-ph23laag94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5728	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296284607213294"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4184	5104	chrome.exe	88
PID 5104 wrote to memory of 2756	5104	chrome.exe	90
PID 5104 wrote to memory of 2756	5104	chrome.exe	90
PID 5104 wrote to memory of 5728	5104	chrome.exe	91
PID 5104 wrote to memory of 4892	5104	chrome.exe	93
PID 5104 wrote to memory of 4892	5104	chrome.exe	93
PID 5104 wrote to memory of 2736	5104	chrome.exe	94
PID 5104 wrote to memory of 2736	5104	chrome.exe	94
PID 5104 wrote to memory of 3920	5104	chrome.exe	95
PID 5104 wrote to memory of 3920	5104	chrome.exe	95
PID 5104 wrote to memory of 2988	5104	chrome.exe	96
PID 5104 wrote to memory of 2116	5104	chrome.exe	98
PID 5104 wrote to memory of 2116	5104	chrome.exe	98
PID 5104 wrote to memory of 1736	5104	chrome.exe	99
PID 5104 wrote to memory of 1736	5104	chrome.exe	99
PID 5104 wrote to memory of 4816	5104	chrome.exe	102
PID 5104 wrote to memory of 4816	5104	chrome.exe	102
PID 5104 wrote to memory of 1108	5104	chrome.exe	103
PID 5104 wrote to memory of 1108	5104	chrome.exe	103
PID 5104 wrote to memory of 6060	5104	chrome.exe	104
PID 5104 wrote to memory of 6060	5104	chrome.exe	104
PID 5104 wrote to memory of 3436	5104	chrome.exe	105
PID 5104 wrote to memory of 3436	5104	chrome.exe	105
PID 5104 wrote to memory of 6012	5104	chrome.exe	106
PID 5104 wrote to memory of 6012	5104	chrome.exe	106
PID 5104 wrote to memory of 2652	5104	chrome.exe	107
PID 5104 wrote to memory of 2652	5104	chrome.exe	107
PID 5104 wrote to memory of 5540	5104	chrome.exe	109
PID 5104 wrote to memory of 4432	5104	chrome.exe	110
PID 5104 wrote to memory of 4244	5104	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://malprob.io/report/cbee972115b129ed3ce366217321a6f431ab86d9bf61c90ef7d224f1004a672c
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb7034c728,0x7ffb7034c734,0x7ffb7034c740
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,11269208463804460787,6456884807792981183,262144 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,9304354574238585294,13205470986702700508,524288 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,14534331394915739496,5883747068179630715,524288 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14980066916975737853,7924693516230315659,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,6139082737957503757,8056738425967864276,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,17966116848792790810,9770606603445848094,524288 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5388,i,9111110131579562499,17309253967206096696,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,2088798756536197395,492140220585222652,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5596,i,5906565192795952017,11730464808525736300,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5396,i,1610991758388127902,17310914936578936886,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5408,i,14563918329445065092,2772608005637239977,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5560,i,15710057143649081888,11120121059429483376,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5688,i,4090369741060100094,2670078181061021669,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6060,i,6963722606501385392,6147149012532992946,2097152 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,10360110973136449049,16141178096977473416,524288 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3188,i,16534383142931960403,9908630810766845597,524288 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,14682487118152188024,6913127316781777642,524288 --field-trial-handle=1932,i,15015082926653525582,16758962012778202809,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 63a945de1464b1965c67bedbba4a2d57a6f686c29a4ecbf0bb3fe3b8e1077b9a
MD5 bb8ce216e2514728449981f900915953
SHA1 880c5d86b24e92b2d247655671c0ddb2003bfb31
SHA512 bff7ece0f990d1e2694bb646d140d0dd48757fe3b02412dbea987503d1573ce8ddd00671ce349b82ac79834d8b86375b596525d74179d5bea5669ac2b1f87ef6
TLSH
T192C02BF01C044226C311027424E508CD33D006EC0B373D809C80089C77D3FB032C1001
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

60b07608-1c51-4393-8f9b-6668c1ad4985.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\60b07608-1c51-4393-8f9b-6668c1ad4985.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9a485706bf6adb89aab7d8ac56593a6667cd3d6491d0c3071d11c9d2b4eeeaf7
MD5 716b5ac19f1968800304957cd478c29e
SHA1 326a0d5945b6a3a1c72813e3a3fd1594cd0456e3
SHA512 e2a461ae550635abec524f96b9aff7c46af27a7cecdacd22173eef1001802cf7cc4f73c9e8eab8821927b7a2103bbeefa2099c27ace22d87dcc16a6d25c0041d
TLSH
T1076170F7C3E8897DC94152F9AB156E1BCE290A1843283D66C8D4DF1FA3E1571E10469F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a7e05c510a91bb62e84a3e62e5d7e56448c084b54a045f20b95db41b1d68c826
MD5 3d28a26ed046a65ddbc4f2c53490219c
SHA1 66912b0bf6062edd2feb432b9f96b28a90aa99b4
SHA512 6c023a00291b0030aabe9246da770211cd0ff91982e2e5a45e7e58c4a5d0444a830b8052df162ba1c0679a4e23d4101d844dd2ab99bc99420fc2691ddcef3ac1
SSDEEP 192:5Rc47pPv7+qvAPRp2rlDy9pHsb+WNnY/bvQ26Qkkwy+VyIsnAUge:5Rc4lHV6XZTwo82WS2e
TLSH
T17632B36FE915693B5CCFD229FD667793E6F5102162A42E84E6FC8A2C20E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c4b24263c63284f1b80ded0c4b85bba55a5c144857f3920334294211db3ac011
MD5 f7494bcdd96832fce6b1a8d668897773
SHA1 0e0bc15c76d721ac89051c42804abcc47472be4f
SHA512 d6f71d653df862f1e099d1b3b7f687a7aac3f8e9963d525718bc48da4cb6c2e3e25f4aaf31aca8ce15f57045c9dfecda4b9377bd1e8ba8b314d24d7b06d29026
SSDEEP 192:5Rc47pxv7+qsAPRp2rlP9pHsb+WNnY/brsEyQkkwy+VyIsnAUge:5Rc4lhVNX8Two8EOS2e
TLSH
T13E32A46FED156A3B5CCFD229FD667793E6F5102162942E84E6FC8A2C20E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ad8b49062b52ad4e0844536ee99e96898fc38f16ef22da3e9267d9a402202afd
MD5 d1593928d7d3aa0affd698bf21ee0e41
SHA1 fa3031101b363ee9efa1209d71fd9c965ed53110
SHA512 19658818288cbed213a7076b118267695e05a74d3e34c7276007253cb58bcea8715cfa0255b887a5e698469a9aeeb07377115ccc8a6f66ee6be87054c8df8812
SSDEEP 192:5Rc47pCv7+qswPRpsrlZ9pHsb+WNnY/bmDuPrQkkwN+VyIsnAUgE:5Rc4lOV5XoTwoUuPxt2E
TLSH
T14742B66FE915693B5CDFD229F9667B53E7F5102162A02E84E6FC8A2C20E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3e68afe-3693-4033-a37f-d198a3e28322.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d3e68afe-3693-4033-a37f-d198a3e28322.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e6e3a52ac289297943fe8dbc072042cc91a0067253c26692a4d825d59eaf7697
MD5 19aa25026a38ab63b646d95411b3a110
SHA1 39ae4d5258433a04ed372dc1d4cb5508e7328e27
SHA512 f44acc036e5df6cfd7494df73f6f9c2e7b07e4f287ad9d3e2f886684293087155d3145163ce8504ef504d22d3c3e7c7159e3dbc4e0eb205af7bd584afec076e3
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok58VDUB6JGyvTNm6zje+PEhiv4a:mC0Nr7OJRPrL9/EtDUD2Y9Imgje+shM
TLSH
T18AA11832A47E9CB749B78549F5563B47CFA4717B9A21EF44A9DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8b58ad3c9878915454f2154c712568dbf564a15349b5572823c5a8cca329afbb
MD5 cef4b1759fa93ac8fbbe22684aa5f89c
SHA1 de1c865e7e23be52fe8f1e5b4c4a22ab5d503f90
SHA512 6258fc10beed7549ac3cbc063a3ca045cb45235fe03c844ede24adfa314dc858c477a9710c977ce71a058ffce9ff2a3a2a77d5ebe1afea002b4b585e4e47c7a7
SSDEEP 96:EC0d+Ar2aetJRxW2rgj0+f+U+/EwZezySl8h4otop583DUB6kGyvTNchCzb37Qfx:EC0Nr7OJRPrL9/EiiU2gYIIcMnEfRyeV
TLSH
T1A4C11AB2A87DACB359F39556B4433A47CEA4717B9A60AF54DAEA1B0C00D70DC1387623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 98f8e0e158de59d7536f8dca9730babe9cd9f95255becbd8d99da9f69f1b4ffb
MD5 5cb280db9918bd4d268735a5220e8c19
SHA1 e42b5f013a0769f8a2a0b62131632195dddf3020
SHA512 537da22437523600eedbebe93453fb27455f772b7ea0200a0beaa585e15d41cb94e747e4bf3cf99161ccf8b33a34f2a089c35b0d4099faea74943039b79d4d24
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EwZezySl8h4otop583DUB6kGyvTNchCzb37Q5:Et0Nr7OJRPrL9/EiiU2gYIIcMnEfRyeV
TLSH
T1A8C12AB2A87DACB359F39556B4433A47CEA4717B9A64AF14DAEA1B0C00D70DC1387633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d6b2c71566b294ab0022cf3d116e6408a936be3b69bdabd898db1ef5d545c17a
MD5 51e628e691798a58257a81e3680a2678
SHA1 f4c4f2adf7d884b4e4c47572a8976ffda41fb448
SHA512 77aeeda0c063c4bc158f85adaff21e4ac7b8e0f8239f3d3f2027fb8375fca16baef58412a8350ddb807f6192384962ac08924ef4fb92f78e78b2aa95a30addee
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EwZezySl8h4otop583DUB6kGyvTNcgQf99yeb:Et0Nr7OJRPrL9/EiiU2gYIIcVfDyehuS
TLSH
T121C10AB1D46E5CA74DF3A555B1033E47CDA8316B6A68BE54EEEA1F0C00974DC1383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download