7ebbd3e32173aa7013de63ce8f8256f07fa7032f29279cd1b9ba1a39afb35786

Analysis

user interaction
yes
max time kernel
899s
max time network
884s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mod (1).jar
Size 72KB
Sample260802-lt84haxtgz
SHA256 7ebbd3e32173aa7013de63ce8f8256f07fa7032f29279cd1b9ba1a39afb35786
MD5 023490f537cc740876e2ccb14cfaf933
SHA1 d69fedb4831389f0ba2489845de074e6ecb5c120
SHA512 cb917adfa2362658aa5c262ea28c63fe223a248d0f2b537016209f44ad480e1e91a6eb1a8ff03960a7e7a9939270a007f22963b7bd63233ff01c6e1678c48f07
SSDEEP 1536:HzAEgfxyPyvm2yiyeAFed23nKd/RcaaBMJQBkP1iOrdcP2jI5FgNy:HzPI+ZtF223nwcWJSuLGF+y
TLSH
T12B73028F3E174616E593CAB1F5086963B56D9C7DCC30600B9DE5B6EE42E0C6F4E4488A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2180	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301379415146337"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
4132	chrome.exe
4132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3984	3176	chrome.exe	98
PID 3176 wrote to memory of 2180	3176	chrome.exe	99
PID 3176 wrote to memory of 2568	3176	chrome.exe	101
PID 3176 wrote to memory of 2568	3176	chrome.exe	101
PID 3176 wrote to memory of 4724	3176	chrome.exe	102
PID 3176 wrote to memory of 4724	3176	chrome.exe	102
PID 3176 wrote to memory of 1932	3176	chrome.exe	103
PID 3176 wrote to memory of 1932	3176	chrome.exe	103
PID 3176 wrote to memory of 4424	3176	chrome.exe	104
PID 3176 wrote to memory of 4424	3176	chrome.exe	104
PID 3176 wrote to memory of 868	3176	chrome.exe	105
PID 3176 wrote to memory of 868	3176	chrome.exe	105
PID 3176 wrote to memory of 4708	3176	chrome.exe	106
PID 3176 wrote to memory of 4708	3176	chrome.exe	106
PID 3176 wrote to memory of 4700	3176	chrome.exe	107
PID 3176 wrote to memory of 4700	3176	chrome.exe	107
PID 3176 wrote to memory of 3860	3176	chrome.exe	108
PID 3176 wrote to memory of 2392	3176	chrome.exe	111
PID 3176 wrote to memory of 1944	3176	chrome.exe	112
PID 3176 wrote to memory of 1988	3176	chrome.exe	113
PID 3176 wrote to memory of 4132	3176	chrome.exe	114
PID 3176 wrote to memory of 2088	3176	chrome.exe	115
PID 3176 wrote to memory of 2088	3176	chrome.exe	115

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\mod (1).jar"
1⤵
PID:1152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9daafc728,0x7ff9daafc734,0x7ff9daafc740
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,16384074620913312384,12331915739619168244,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,6199564355658679776,11984925220666612827,262144 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,15383822322941246417,5307813306034035886,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,14174128040211863121,12860589018511908561,2097152 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,15884929464292020149,17871883553242104513,2097152 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,4803470207073052796,12464203168631715123,2097152 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,18292133501434837691,295513852079130564,2097152 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3932,i,17704975235993805588,15371191260926191450,2097152 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,9890573611120301916,7194039102914732879,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,7859403658969502446,596466637847458065,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,12198360645186462167,17007363508421643253,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,11669927407130121662,18301731281997624898,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4580,i,13693387523609251383,10766716332683709621,262144 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,4759982019274397101,7283244479337139558,524288 --field-trial-handle=2056,i,8824282940689801317,6671082938042101937,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:2088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a292c278cc99d84b2be7eabfeeae6bf92d1d006a701d6dd0c0e08c1e680952fd
MD5 386a18983ed9174362b09b875073ddcc
SHA1 5db7f112a21647a252e8db6efc1ff10b36d586da
SHA512 343ec3e62467f924d9a97449f2c7980bef4436d5dbc0ea5fbd43bf975b531f13dbf8e492aa2a24e373208b356d1e9abbeaf30a96914dc8abf0b022aac8e4c865
TLSH
T118E022A6CC21AD772DFE471810915B46EA6513162A908E3F3A3CE61C8FB163A4596C9C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cb35d4f5579bc5c20c3a6f6f7f2fc8b78fd09d3e41c63702957c0aa35cc25bb7
MD5 c25cc41c999b6d68bf734e9003c71588
SHA1 62787839bcd3841fa96e65a8bded6ffd346c40bf
SHA512 d7c98285f989fe5c6aaee62b18c6d5333d187734a88225c08a26dbbf639bf4f8dc755e1ee1ee993d5cdab366617efa1d8d05d2a87ac736d3fa8fe9fd9e89eb13
TLSH
T1F951AFF793B4856DC61196F4DA14AE2FCE790924032C7CA6C8D4AE5B83E2972D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d538117c481d339d5313ef3a8ed3c5684053484df07348db5b290a24248f261a
MD5 8b7eb5d74df5610576baea5fe0f0233e
SHA1 88c68ff8142caa76933b8bacb5c07deb1eac1356
SHA512 d6bc236e86fa6aece2f3439174591ac91bbf6c8924a18f9f8d97b6d8be064a53d9d58e5971d7ee0cabd2b339a58df61fd57758c194e0b1b95e8aa9b32ca32530
TLSH
T1E6518DF793E4856D895156F4DB21BE1FCE2E0A24531C3C6688D8AE5B53E3972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2b428774b358152b39fadffb72f28436e91a0d295fa3838422c0a1f92a237f86
MD5 9e3e490017f10e17629120a4c87120ef
SHA1 920670dd7e6518ae6fc5ad438e7a1ce3205e9040
SHA512 b9f4866982e2df17dc51acb716dc5456fc8b94fce91bd4b9cb91e0596463a69ecd4bd78ce58cff917901d95081622a3f87816b6f5f2d153138453086d8a650af
TLSH
T160519DF793E4866D895156F4EA247E2FCE290A24432C3C66C8D8AE5B53E2972D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c41c21a3b7268c3c804340f74f472d1430562e2578a741d71bd13ca91b81a65e
MD5 8303c5502252ce51fd9638908991140f
SHA1 bb84cb05e3316fa17ae1aec680e7ad13fcc30ded
SHA512 3cbb72d57b651b3644080d6012a68338e1333b3c5b24a709f25a06f2f735c0c85906e3bcb87f9b477ceb837987ee959a8ecde7e008f19c0a8f129adb54e229be
TLSH
T1F051AFF7D3E4856D891156F4EB246E1FCE2E0A24531C3C66C8D8AE5B53E3972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fb981375e3ec06a17fb1d923fe461e2cf555077aba9eb3bb1466824257532877
MD5 ecb45b43073dd15ce9036dcea4eaa30d
SHA1 728a709e0ffe836e101b32e183c4ac3b413d0a2d
SHA512 bada192c1aa6ac31294cc12e8cac5372e0734b0bcac882fcd5fdbfdea625d756795eecd1976415dd0bfb8704acb82232839bb92b00eafeecaba03e37da1922e9
TLSH
T1365191F793F4856D851196F0DA14AE2FDE7D0624032C3CA6C8D4AE5B43E2572D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 860eb3d2c9636850a788f412c3bef75921aa07757652c8cdb0ace080ad45aaa1
MD5 c7fc189fbfae39058eb6a79cc4ac9a3c
SHA1 c5ee1fce024d3bcb4bdff721ea86dcc90cefa1d7
SHA512 3b867dde6ad2c94458ccabf4ce0848f9a9f3d1ed11b191ca6e845c4665ced84f72ccdd98f14460d3065a98b01780e2c671f6975f06812cc556f2eac6bb4a5d0f
TLSH
T157F050A7D2797427617DC5B71D047C0D3976A4350B4019F0CF5A412CE0C55E31B11457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c32fe0859e79ee6bf91415d317fd9de4a2b46c3bf2dd9b9161017611669e51b3
MD5 7b67aa1dbdb2153ed68b83fd301df355
SHA1 d1214acd54cfdb658e40c09b30e7bc0764033555
SHA512 ba6a7d7b171dfc3230b38403c1e95811b73c2bc1e31b2fd9415fef0d0b04ed0e5cadf5879c8d807f40d1e499a4c0d3ebb6498537ca9985924ff9817ac68a2394
SSDEEP 192:9R6QL/zv9xJKv7hpAPRp2W95Hsb+WNg1p1M/I01Pxem2euRfa/iyVyIsnAUgtaJ:9R6u79G9UXtrw4kI0192eula6y8
TLSH
T13842C62EB914643B6CDBC219FD223767E7F7142135A41E84EAFC896C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ea544c149d95f3ef24cd962825c2fefe9da68f283f56c36769ac1cb23065e0b4
MD5 c2bb067a3adf5d1ae27aab74d8691b54
SHA1 0baf0c99af9db610d962da6ee781bb4503c2c2b3
SHA512 634c6e55dda68269776ad88d3b5c4835f81ca4cd0e1a359bb1022c299ff47d25ea6608243244177895650564ed681aa7ba8a797b358309a4d1cc61c11059e2fc
SSDEEP 192:9R6QL/zv9xJUv7hpAPRp2W95Hsb+WNg1p1M/I0axem2euRfa/7yVyIsnAUgraJ:9R6u79Q9UXtrw4kI0u2eulazye
TLSH
T13F52C62EB910683B6CDAC219FD223767E7F7142135A41E84EAFC896C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 08be3f481eacbb813d2e847af8580dd708198d5c9e230fdbe1a35d4fe5ce1bf6
MD5 69b7df26182008f40112057bcb602392
SHA1 4418597745cd48c96b541d9d4f31bfc77316ef62
SHA512 9d1fe29c462414a471233f6ffe9f7a3820de25a3f76c7ddca428de334e8687075dd9092464c7854283c1ac9eba6d7bc44985c772b7318ebe95638aac44455ec3
SSDEEP 192:9R6QL6zv9xJUv7hppPRpRW95Hsb+WNg1p1M/I00xem2euRfa/5yVyIsnAUgraJ:9R6um9Q9vXYrw4kI0o2eulahye
TLSH
T18952D82EB91469376CDBC219F9223B67E7F7142135A01E48EBFC892C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2fe6a3f500f10c2e56551b7972d9bc7d545ff896859665a8290cec405614a058
MD5 d2ac1157500b299b0041736650a69fab
SHA1 0f966adbfc8c3025a80c9332c7f484cd5b805229
SHA512 2c88996160eae6b3885cf9936311c648e78ccbede300ae98461f85434c183add37dccef70d28b7994d6be5ce27b9692db339214276aa8fe0f85cf9bcc4aab2fe
TLSH
T127B0122680016541C48202F01192548872946F20960A1F11C3F06E32C8299628025051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ee0f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ee0f.TMP
Size 96B
SHA256 204e6b532aec40dc43a36ec1211ffa905bdfefd68b3c4ebb6958e332cce90267
MD5 4b02778caa49c5bff45125e0314022fd
SHA1 d6deb5070d0c0fc5bb028f412c89e16b7f187da9
SHA512 b97dbba255f3be2ee4244702fcccb6456d9877c5e798977ec8067fa1bfd93063ba382a5df2f0f850bf6960d91a70d2a4f6361e5a4351969ba7c9738a0a6d10fb
TLSH
T14CB02202C002AB82E00203B02082A2E832A0CF30C203030283E00A32CC382300020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 dbfe31a5a2892fea4b352a8e700e0a7cddd099e5833fc2d8f830e4ad1c35414a
MD5 b679e6b955aacf56cf7d801665611937
SHA1 c5be2acba6a069b9a0942f939c2af4972e6310a2
SHA512 4bc2e932bd850bdc0224caf7bce626de0693baf77bf2720f41bb5c5c4d24d16224d95d66fc0dc8c3941953fad12cf3cbca64a18df52f0de6a9992441963204af
SSDEEP 3072:kmyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwuqfd7NtZL8cHQRZEQ6Sps/:EaDuqWhGX9NwJUwcPqZ/ZLW3Ex/
TLSH
T1C2342236DBC52D26ADDE8360F657066FE7B7885D4070D106E5D837ABB8C38A44C824BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d7c1a7ca1560d5cfca87029e19b615dfc13197f5f5da37fc53f48609693e9c85
MD5 0807b43de4bb76bd2f8c83a55fc9cc27
SHA1 bf6d0e87af46df629e04d6824adfe38f98f3e98a
SHA512 d11e8da8f72373799dff294b86222ca8338776f8e56d432952928a6e7bc01898657b56abc880ad488ffff30420225b74946c2286d75f0ac30ad2af815391932d
SSDEEP 3072:9myC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwuqfd7NtZL8cHQRZEQ6Sps/:naDuqWhGX9NwJUwcPqZ/ZLW3Ex/
TLSH
T1DF342336DBC52D26ADDE8360F657066FE7B7885D4070D106E5D837ABB8C38A44C824BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 84d4221a3bad3cd5f8df3ed2cbeac5e19ab1a7aed297b53fe07e3b20680bfbba
MD5 992120611ec6ca95d24bbc491ddee1ed
SHA1 623d48ba4bfdae12067156e9c8e3a6a9883e0f17
SHA512 1e6ce6ac142b6731947c73aa7f715785d4a2963dc7c8f7f2d23355b23df2aa860f40fe7aa74456652cf843aaa19a31801d90e79e1cdaad2fc1ba9d853e979878
SSDEEP 3072:fbyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwuqfd7NtZL8cHQRZEQ6Sps/:fGaDuqWhGX9NwJUwcPqZ/ZLW3Ex/
TLSH
T1E0342337DBC52D26ADDE8760F657066F9BF7C85E8530D106E9983BA778834A04C824BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 768492db60acca1a146227610be07c765cb49d85f14b456830c00584ec6f74da
MD5 64ba2c0d9325416ad63c90ffda454a3a
SHA1 6e78121ae478fe71eb9bc174d7d91d2b432aa50e
SHA512 3d81f90cfbe3da0f0b0f2913d8da4a8e6bceaa28994017b38df6f73a355134080c7921745054f3853bb874bee58cbbb2d51ca09c415237f002ffca69f6733960
SSDEEP 1536:6GyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:tqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1DAC30237EBC21F339D82CB64BA534FD6A7B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 108b656c71902c419cbdca1db30449b044bdbfba613d82cdc1d30f7c867b97dc
MD5 cb5d1dcf4641272bb04c2b5edb34738c
SHA1 2b0ec4e06b0fe0fdadc14d1ce765afb8314f9609
SHA512 719e5f8b4f30a5609ee8e36f990b31d63c2514e691dac7fec2d420eb36aadf65a6c52c1ecb0e4b098843607652a9c755ed5517d27eee10a751eb0982ec2512bd
SSDEEP 3072:zbyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwuqfd7NtZL8cHQRZEQ6Sps/:zGaDuqWhGX9NwJUwcPqZ/ZLW3Ex/
TLSH
T1BA342337DBC52D26ADDE8760F657066F9BF7C85E8530D106E9983BA778834A04C824BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-2-0x00000179C4AF0000-0x00000179C4D60000-memory.dmp

Download

memory/1152-13-0x00000179C4AF0000-0x00000179C4D60000-memory.dmp

Download

memory/1152-12-0x00000179C3320000-0x00000179C3321000-memory.dmp

Download