hxxp://url5178[.]xnetwifi[.]com/ls/click?upn=u001[.]xnwt7OMALDqRym63FpaR1VuricEOmlRhfzMP6GJ2Cl9OwZv-2FjKcNG8PWpr7WaciQEf1ZFB99J26Hqui3RQgDd6Cn37DSo3HlnR9HD-2BtaQsjWs2E8KtvxCIyTxKpGYhICC8lM2aBAZF-2BCZ-2FcbKog2AWloRsxZhPcyuzZ55uSYXXSOg82De4eBijjkLP5KAvktDnOBE1pZe2vFHnH7Y2t-2FqAZ9RInRkqXZDUZYcR2iB60YGiwWlfbd-2FD-2FSUBRzGv3MWosaHhU82iP9jUybK7ACbA-3D-3Di-mz_N-2Fi-2BiwVoAISdyJWKD5DL8JZKsY4itNDf4gv7y7oD2lB4VrZDqIHGIdxvGfIiG8u7qpCchK7TIFvMMpUrSZhEiSyXQiTvx3ttg2MNCpDxko2LzTUW80TCyR9UiHPoOBprAju5JTBJzXng-2BRboz92H6ZPu9MFBjoSirXsy7V1O-2FjYwRd-2FqyU0gPmqTemLAliZHWDt0zGqHylJirgyyrtQGiw-3D-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url5178.xnetwifi.com/ls/click?upn=u001.xnwt7OMALDqRym63FpaR1VuricEOmlRhfzMP6GJ2Cl9OwZv-2FjKcNG8PWpr7WaciQEf1ZFB99J26Hqui3RQgDd6Cn37DSo3HlnR9HD-2BtaQsjWs2E8KtvxCIyTxKpGYhICC8lM2aBAZF-2BCZ-2FcbKog2AWloRsxZhPcyuzZ55uSYXXSOg82De4eBijjkLP5KAvktDnOBE1pZe2vFHnH7Y2t-2FqAZ9RInRkqXZDUZYcR2iB60YGiwWlfbd-2FD-2FSUBRzGv3MWosaHhU82iP9jUybK7ACbA-3D-3Di-mz_N-2Fi-2BiwVoAISdyJWKD5DL8JZKsY4itNDf4gv7y7oD2lB4VrZDqIHGIdxvGfIiG8u7qpCchK7TIFvMMpUrSZhEiSyXQiTvx3ttg2MNCpDxko2LzTUW80TCyR9UiHPoOBprAju5JTBJzXng-2BRboz92H6ZPu9MFBjoSirXsy7V1O-2FjYwRd-2FqyU0gPmqTemLAliZHWDt0zGqHylJirgyyrtQGiw-3D-3D
Sample260804-z7e98s1amd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4600	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303520882722459"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
4780	chrome.exe
4780	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3332	3644	chrome.exe	84
PID 3644 wrote to memory of 4600	3644	chrome.exe	85
PID 3644 wrote to memory of 3352	3644	chrome.exe	86
PID 3644 wrote to memory of 3352	3644	chrome.exe	86
PID 3644 wrote to memory of 2376	3644	chrome.exe	87
PID 3644 wrote to memory of 2376	3644	chrome.exe	87
PID 3644 wrote to memory of 4236	3644	chrome.exe	89
PID 3644 wrote to memory of 864	3644	chrome.exe	90
PID 3644 wrote to memory of 4236	3644	chrome.exe	89
PID 3644 wrote to memory of 864	3644	chrome.exe	90
PID 3644 wrote to memory of 4228	3644	chrome.exe	91
PID 3644 wrote to memory of 4228	3644	chrome.exe	91
PID 3644 wrote to memory of 1148	3644	chrome.exe	92
PID 3644 wrote to memory of 1148	3644	chrome.exe	92
PID 3644 wrote to memory of 2956	3644	chrome.exe	99
PID 3644 wrote to memory of 1152	3644	chrome.exe	109
PID 3644 wrote to memory of 212	3644	chrome.exe	110
PID 3644 wrote to memory of 4700	3644	chrome.exe	111
PID 3644 wrote to memory of 4780	3644	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url5178.xnetwifi.com/ls/click?upn=u001.xnwt7OMALDqRym63FpaR1VuricEOmlRhfzMP6GJ2Cl9OwZv-2FjKcNG8PWpr7WaciQEf1ZFB99J26Hqui3RQgDd6Cn37DSo3HlnR9HD-2BtaQsjWs2E8KtvxCIyTxKpGYhICC8lM2aBAZF-2BCZ-2FcbKog2AWloRsxZhPcyuzZ55uSYXXSOg82De4eBijjkLP5KAvktDnOBE1pZe2vFHnH7Y2t-2FqAZ9RInRkqXZDUZYcR2iB60YGiwWlfbd-2FD-2FSUBRzGv3MWosaHhU82iP9jUybK7ACbA-3D-3Di-mz_N-2Fi-2BiwVoAISdyJWKD5DL8JZKsY4itNDf4gv7y7oD2lB4VrZDqIHGIdxvGfIiG8u7qpCchK7TIFvMMpUrSZhEiSyXQiTvx3ttg2MNCpDxko2LzTUW80TCyR9UiHPoOBprAju5JTBJzXng-2BRboz92H6ZPu9MFBjoSirXsy7V1O-2FjYwRd-2FqyU0gPmqTemLAliZHWDt0zGqHylJirgyyrtQGiw-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe007ac728,0x7ffe007ac734,0x7ffe007ac740
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2004,i,10640143067457325720,1651245547735259041,524288 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,18334399815363271864,3232872160122554986,262144 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2412,i,16279461232490868285,12542077508281752319,524288 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,16810062321871310000,1172852765376688437,2097152 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,6160521984027102571,12211749056934729993,2097152 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,1312927507042801078,3910914641986455702,2097152 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,14050632145484583754,12518162730311782759,2097152 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5304,i,10146071302119045067,518818071592696950,524288 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5568,i,9421961095592410264,13147999296542363241,524288 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5624,i,16644860870210245875,8662489260458826614,524288 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5696,i,11098963534205796302,14787222986978078091,524288 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5744,i,6225758128874087819,10492400740806264807,262144 --field-trial-handle=2028,i,18242731455226688531,18321733348526374206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bb852ce44d9102008b0d19f356f1cea5302416c8d932a36b35bb9edb538512e2
MD5 db4b3f62b9e9e98e8fe183397537b795
SHA1 ebe755ba5a3ec17f2c0e07b974122e1ef55fd126
SHA512 41afcc564c39f82fc6489262bd5c2a2a629d3a2dacafd5785d2c4a5fc3841b86884d3c42c87d6f16028093f3fdfddbb8c9040a92b84fa3f2f25508d2bc3240e4
TLSH
T1C0E02BA5CD72AC3718FC175864654705E642235B2A80D85F373D504C8FB473A8197C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a57d7cdaf868e5e44645ffa6f8ff04c2ec6e5717358049413619f2aea9818ac4
MD5 aea71089c2199ff7a49f5599f4222d20
SHA1 61353772dd0067461ebd97f2c26ac18f31f4efed
SHA512 99f4e40b93e5ccc26d69694fc89ea98f3f516640f9e960b2e1a8aa1250aed95aad4ee544cd6900990ad0d1d3ace847a531bf981845b7f6855e804b63bc4998d9
TLSH
T15C4190F793E4857D851196F4EB156E1FCE6D0624031C3CA6C9D4AE1B83E2872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2031f5010e199540b11de9d3e6f70ca8a08ed315e674096f4423155469824086
MD5 2fc1146ab5a69378fc4474d23b513365
SHA1 9e39425be306b575f53eb14cf1a176bc70718dc6
SHA512 27a7f7fd8b4be4f8be6f59466063a5eb1cce9652cd9aa94c2abf65b0465906da61fffc61f60e6ff7016551b6edb5ac16e4d549e87e2f989eb7f973bbc0d8f0c3
SSDEEP 192:FREKoNo8/I5RjH9Vx57aJv7MF+pAPRp2GEw9HH1EDb+WNnEKSprEO4R2CooUwarj:FRA7ERvxMgoUXR1aWg2karYV/Sae
TLSH
T1E042C72AED11697B6CCBC229FD22B767D7F6103120D42E84EAFD892C15E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 45dd145792ca02caf99d90fee7903dedb8b0108b6e559d653c0a546c64286cb4
MD5 3d6b8b3a478577d360a959594f976573
SHA1 6af0634142853f5ca2c47d135191bc816c22e98d
SHA512 54835ddaab9233fed9b7d651796967ad83ad89173a6e5f484448a7862b36585d1ccf20a468eb0352652fe026d27c2eb2fbf78be626cb7b250f1d0208408494e8
SSDEEP 192:FREKoNo8YpQJ1oH9Vx51Jv7MF+pKPRpkGEw9HH1EDb+WNnEKSprEO4R2CtoUwarz:FRA7EQCxNgo6Xj1aWg25arYV/SQE
TLSH
T1C552B61AED11697B6CCBC229FD22BB67D7F6103120D42E94E6FD892C15E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7e31975ed6b20e855f3083f2c91881d060f260f67376d50ac8867605fbb1be7a
MD5 b75fd22b4f5da113b5c9d20abfef89e2
SHA1 72b56137728470dc4d8a551c6ac26885e0d9d34c
SHA512 b0df646f94b9a0d42f059c77c0b43f48bffd7165b656156305c7d7a5bafaf7783c0df8db26c1f1c5d809249055748c3785d23a45d169d99eb262181b33be62e2
SSDEEP 192:FREKoNo8YpQJ1oH9Vx59Jv7MF+pAPRp2GEw9HH1EDb+WNnEKSprEO4R2CCoUwarR:FRA7EQCxBgoUXR1aWg2oarYV/S2E
TLSH
T1AD52B61EE911697B6CCBD229FD22BB67D7F2103120D42E94EAFD8A2C15E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 abab0ca242895a07a32a8a95ac31a118afc79154a04a5fc95daab208ce2856f5
MD5 b3b8a5a84035b494eae8a92528970d86
SHA1 574bec83330048c0bc4e8de4ca4ca6c4ad2ef24a
SHA512 a75163bf85e90643ae825a9cd3616a4341d1c330dfa609166300161334a7a0d951f3076e6b5bbb03937d7dbae9e2bd14755c58f8fb59db1eb1c982b520cba6d3
TLSH
T162B01280C0016211C00202F8156214D87118AF10970A2B0183E06A32C82D2908618050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b495.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b495.TMP
Size 96B
SHA256 d117d7971b9fbfc108e7f373d403ed1fd16defd60f122196bd104ea15053285d
MD5 b331b15cc5a3e6c1c5054065856db377
SHA1 ca3da16a83e2c07ba38d6dddf1ff65c79230bac2
SHA512 d82140eeff93b3226264786cef123623109620d23b4c9a500ca410b558b4a45997f1350f2ac7818f9b55006917c52c45a7c195852a13b6c1afd5aafae2b5cdd0
TLSH
T133B00255C1026326C08203F02A9596ECB5A5DF25C7031257D7E06AA6EC256A0566B670
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 534151825b872444f084838c9d367be716818e05918d010790b6061a2e651125
MD5 8dead68df80c51fc5dc40e3cf00f5ef0
SHA1 e3de8479e9aadb4e32df6a3b13f9f42299a8691a
SHA512 12aa061e5ad4a039b90c57e4368cc38a5b2b5ca9fe8b514fccf70222f68202c3dc1d085cba0592fdd92b09d06be8dbd8e78960cf8f17c0f804d95045706b4607
SSDEEP 3072:dcGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:dvm7Rkm1tYpBeh2BAoM
TLSH
T127C302375D75A83759B9BB1EB08E0A1F1EF14AA6D830DE52C8D85A0433F96CC1A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ea5b748e5da341702dcf9bf5107c34d01a9da8aa09c111d7cdfdbc92d1eec557
MD5 6b6ad5bbdeedfa3ee325339017772313
SHA1 cd47fcdc1d0bd9087661d7631c5aba15147e37ad
SHA512 dfd6d2778b386ef8a3381ed788be135effb7487c6f994a546e9811b58079cef88f8107af64c12c39c485005c43de98e54a8779a8557e0037025091ab343d0f96
SSDEEP 3072:/DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/6m7Rkm1tYpBeh2BAoM
TLSH
T189C312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 eddc1356c7a83e70634ee0ad66b92a3679a07da77ef6481c00762a3d959005c8
MD5 eb14f5dd08a420d0a567c4aafff77755
SHA1 3347e386dbae70dcc7bce852c55bfc5026f48bac
SHA512 743840e53794f7dadfbbfd984d73419bf44d51f31d16dcff2509b059d0ef08c99cc910bead8aa3330ea07b9a663c647ca41f740aa8d40f86ad417690849077f6
SSDEEP 3072:uiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:uVm7Rkm1tYpBeh2BAoM
TLSH
T152C312275D75E83759B9BB1EB04E0B1F1EF14AA6C830DA92C8D85B0463F97CC1A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 340a1efa4147945252eeb41f3023e0a6abf1402020cec4b56a1bd7e0e5d252f3
MD5 afa2a9100df2da0819d3cefd3adf68f6
SHA1 ddbb8052f4011be1677a00930a8ecd846e0384b8
SHA512 c1e9a2298f7674d30e57b356210f34cb8c9d21f2735ce0a26599b2c0752d5a189522eebf88dd76d75ee74a6c51301fe10e05042f075f83e47fb35783488f690e
SSDEEP 3072:diGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:dVm7Rkm1tYpBeh2BAoM
TLSH
T152C312275D75E83759B9BB1EB04E0B1F1EF149A6C830DA92C8D85B0463FA7CC1A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download