hxxps://giezdaareocukxi[.]smart1stmsk[.]xyz/xrcuerjjcxjzncy/sijketfozvxbg/Zhhinidhnkkuhwe89g0xmaersk/hrcjyfqmrnbupz/pppbzftslty/daniel[.]hoffmann/xrujweeeuuo/columbus-clean[.]com/dyrixqujvilf8

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://giezdaareocukxi.smart1stmsk.xyz/xrcuerjjcxjzncy/sijketfozvxbg/Zhhinidhnkkuhwe89g0xmaersk/hrcjyfqmrnbupz/pppbzftslty/daniel.hoffmann/xrujweeeuuo/columbus-clean.com/dyrixqujvilf8
Sample260806-mlxaeahb67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2820	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304860373408021"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 4072	1636	chrome.exe	83
PID 1636 wrote to memory of 2820	1636	chrome.exe	84
PID 1636 wrote to memory of 3188	1636	chrome.exe	85
PID 1636 wrote to memory of 3188	1636	chrome.exe	85
PID 1636 wrote to memory of 4712	1636	chrome.exe	86
PID 1636 wrote to memory of 4712	1636	chrome.exe	86
PID 1636 wrote to memory of 4940	1636	chrome.exe	88
PID 1636 wrote to memory of 3388	1636	chrome.exe	89
PID 1636 wrote to memory of 4940	1636	chrome.exe	88
PID 1636 wrote to memory of 3388	1636	chrome.exe	89
PID 1636 wrote to memory of 4872	1636	chrome.exe	90
PID 1636 wrote to memory of 4872	1636	chrome.exe	90
PID 1636 wrote to memory of 8	1636	chrome.exe	91
PID 1636 wrote to memory of 8	1636	chrome.exe	91
PID 1636 wrote to memory of 644	1636	chrome.exe	93
PID 1636 wrote to memory of 644	1636	chrome.exe	93
PID 1636 wrote to memory of 2264	1636	chrome.exe	94
PID 1636 wrote to memory of 2264	1636	chrome.exe	94
PID 1636 wrote to memory of 4296	1636	chrome.exe	97
PID 1636 wrote to memory of 544	1636	chrome.exe	111
PID 1636 wrote to memory of 2144	1636	chrome.exe	112
PID 1636 wrote to memory of 4340	1636	chrome.exe	113
PID 1636 wrote to memory of 4468	1636	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://giezdaareocukxi.smart1stmsk.xyz/xrcuerjjcxjzncy/sijketfozvxbg/Zhhinidhnkkuhwe89g0xmaersk/hrcjyfqmrnbupz/pppbzftslty/daniel.hoffmann/xrujweeeuuo/columbus-clean.com/dyrixqujvilf8
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb70f4c728,0x7ffb70f4c734,0x7ffb70f4c740
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13410248427101472108,1060981738121577798,524288 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,9356092695323613971,18166321923744376438,262144 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,7053811025855899824,17687224706435127327,524288 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,2459038044631200405,2057545307992804512,2097152 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,16609432678233510918,17024351429627185088,2097152 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,16601139741190434030,1435078925701690164,2097152 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,12580149278423596762,12745146137125828817,2097152 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3288,i,3845996806817093911,6143735201540589197,2097152 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5088,i,14436108591397102901,7345322027085860746,2097152 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,17740004581787059718,16197978676896540285,524288 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3224,i,9187268179374021720,8099372405364363795,524288 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,5637597900475636375,6050627684255165938,524288 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,7353760318215438922,10917714641232811171,524288 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5972,i,12861261720314932294,9615264863138844896,262144 --field-trial-handle=2064,i,15795933418464622260,4032013797368596225,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 053d18c4085aede7db00f0580a9936aed3e79f78b6a46fabcea8b0ea20949d0d
MD5 5f1866a120e18c2fdf1a7427a2b7a2e8
SHA1 b972814af9046e147608132241921690840c5285
SHA512 9088f69e68ef197affa464339530cde1635dc4894fcdc5094f235ab0e9973c097b332d44e7e4801426b22f5e8af29a98a1621afe5a7ab0e33480868b650ae3f6
TLSH
T1B4E061D6CD31AC7B1CFD0B1C11A14B06EB56135B2AC1491F3A3CD21C4FB163A4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 17830b103cf5f093a4fea9efa65270caa393736e2b3481ee598cde94c4be2f02
MD5 0a441edfbdd99f651aad5149e84dfc64
SHA1 6ff42949b780feabb6a3bf741bc903dff7fef4c1
SHA512 da8e3379e6acf71975ac795f139323e7484b5169da61451d2ebddd272c35ec03fff5854cec36e8c6532e2645eda34425da8f1bde23d3a26adb0723a023f3bfe6
TLSH
T19FC08C1092B82422CB2236789873080822000D89A40E366381C1808271399A1E10C463
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e5bf56e83fe9bc15e7d7814a26a057b13f7d45520092d2085cd453875837b9c5
MD5 f59c9255a341b6b2baa5ff2fd7a9d1b2
SHA1 f384bf5a362f834d17d33d3b395009ee3b9d8061
SHA512 acea70d4be1e29695fcb9c9dde0a830f10ec5684b9482cfc10ba6fa2351d10b37ec465a46e399d66d173f91c5dc0ff1e1cb75f321cbcea7ea32ef486043a34d7
SSDEEP 96:DfrUarJsqhZaIaEdUpDgCNa3mt53kU4vw9mYlK:DwQthZaIaEdUpMCNa3mt53kU4vw9mYlK
TLSH
T17AC17EF382F8C97D895152F1AB557E1BCE6D0528531C3CA68DE6AE0F63E2871D2006CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 92984ac35d266983caa6acd504674d146990fe8acd457d5e5e004ba8e77f5874
MD5 bffcf91275b9e6e23013da0fb7575175
SHA1 5c56e3467fbdb7e4eb63072883e6fc452bed8243
SHA512 3ce43879ebeaf2ad434075ffbee71983216b3a7401c86dc0a0b54d490b0f02a400772ee742a1ea321b8667ee7b88398ef0d1a38faf130a236a0629372f92031a
SSDEEP 192:LRX4LiBJ+Xs/v7hpAPRp2bJ95Hsb+WNn+g/9B2W0XkwkO3NVyIsnAUgE:LRX2QGQ9UX+rwFD2bXEO3bE
TLSH
T1FC42C72EBD14693B5CDAD229FA627B17D7F6103125901E84EAFCCA6C15EB9CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e325f68ba6ea1de229db77582df23747b0708402d8cb3df0ed471c3246a15b61
MD5 d8adbfe9880cd993e23915eb6ea97b62
SHA1 db4f47a3eb1d156b771e94d30330ebe6de888dcb
SHA512 0110486ba4e386b19eaf6546aa4fd693256eaecf11c91be132d998bb5434ec2cae1eb3cb1fa30dcb269ff1c7add5b71d64bef4463726e75fe2c8c7afd9841d22
SSDEEP 192:LRX4LiBJ+Xmv7hpAPRp2bJ95Hsb+WNn+g/9B2X0XkwkOkNVyIsnAUge:LRX2QGS9UX+rwFD2kXEOkbe
TLSH
T1E842C72EBD14693B4CDAC22AFA627B17D7F6103125901E84EAFCC56C19EB9CC321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 10113f0e164ce383dcad791d3cfd9cfda57b9f93db4dc1ccc988a41afc94fcfa
MD5 c50b73296758cbde6a508b87c4a70e67
SHA1 b707fc83e9b9725317e01f205811244478cef6db
SHA512 645bc8d9095c7b6d614269c3d9d72940689a46a713ce12ab1dfa9990e86a59020857b243448ca6f4bb1f4f60ebbde5ae92030ecc933effdfaf9967843296d298
SSDEEP 192:LRX4LiBJ+Xtv7hpAPRp2bJ95Hsb+WNn+g/9B2X0XkwkOkNVyIsnAUge:LRX2QGN9UX+rwFD2kXEOkbe
TLSH
T14842C72EBD14693B4CDAC22AFA627B17D7F6103125901E84EAFCC56C19EB9CC321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d613536717313fd223b24ae9319bf836ac0550fdcb7c230694a2d231c16f8a71
MD5 6473957f12f1b065d750dff7b983aa87
SHA1 b6a066b8eaf5f62cde282cbfc6bbdb3d3c3377cd
SHA512 3eb47d43ea3f5164dc785c2d1efb092296dee4b4ed0d2c196c86140b87a8be1ac3f3821ddd8208c90e0e30bcb7fb1701f941b19b9fad9c6188e8216f569c2b97
TLSH
T12CB0120184025201C04206B01246148C71345F629A0E270243F4AD22C8351618018151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aa26.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aa26.TMP
Size 96B
SHA256 d1ef1bd1cbc49e31be792d1e6bf582beaa6c0037b5275cdadaee029442f9b513
MD5 957dab07f459bd408686efee7df28f4e
SHA1 80e3f18550f7a18fb2f60b5d1e400e66f83119a8
SHA512 14f16050f7ce5cb0792cbc9f00fe5379cf1f41b13572c3b3b3f240bdabe3f1ed08016e96b12917668dbcfcd35df1add951d71ea31aeadc9c13be8bc3518f3f03
TLSH
T1C1B02208C002A222C00203B028B08BC83020EFB2C20B220BA3E02A2ACC3033000300A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2c38f3ff5ac5fc04252d11a929d98a5354e3caa3a4a61a8b7abca0be3287de18
MD5 bc7bd43100ee84754a8ccc500f189aec
SHA1 3fc6b0bfb804a1b9f9addf1fbc37106689a03de6
SHA512 104c1dbc553e06463d596810e9284817c64684a4a03047b58ed1ff1371e9be0b5c1929087fc9499f50bf8ab3421d4b8f715e65b510a64b896a83f469b26ae6e4
SSDEEP 1536:/5ZyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:B3qfd7NtZL8cHQRZEQ6Sps9
TLSH
T1B0C30237EBC21E339DC2DB64BA130FD793B644A99034D301EABD2BBB6C93455648249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 09d463144a1418ad4982f39c1946a1be6055d07ec343caf3e7b79384b908d071
MD5 aa757d364e89797e9ee6500c79280027
SHA1 6963808646ba3724291dc21857e46f3010220598
SHA512 931a79ef1ce1dc4e7787f28d5be9c815884fd46e8a42cf9d0b11ad4ea03f89ca6bddbfc38b5f14f5d0b4b322bb357b34d4d5644cf403b9e67f4b678d9c0820b5
SSDEEP 1536:/apyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Snqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1DAC30237ABC21E335DD2CB74BA130FD797B644A99034D301EBBD2BBB688345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4d0aa83a5ad640a1cffbffbbba490b76956787694715a9c854c0ec79537d3835
MD5 c7ef91690eca122584f86d499472c47c
SHA1 c592800fb2457f387ff5018b771a6670a15cb8bd
SHA512 78172f6312d1126a09adda953e190da3ee203e4aa77683df528e6e3a4b5ef13d2215259a5754518cf9a700565b2aac0c02dda7cadc38110771ef20822f0924b8
SSDEEP 1536:6jyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Aqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1D0C30237EBC21F335D92CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 513a1fdbbb3d0814a06f03fdc1980e8f0b4f0210e07bd7d6b49ec025d3126ce3
MD5 eadda66218c28459ed9f90b82a6f54e4
SHA1 35c0e256c6c51413a41aae98e8b25507fd4a90e6
SHA512 c5cea351835a9a055a02a675c1aec8c4f4b2875255d13e6e8c3ee0613ddb6b37e5dc293d0b4d8f6aa51d2bf1781d09e462688eb9f1ead20bd4d7e0982db8d2b5
SSDEEP 1536:2apyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:fnqfd7NtZL8cHQRZEQ6Sps9
TLSH
T16BC30237ABC21E335DD2CB74BA130FD797B644A99034D301EBBD2BBB688345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download