Analysis
- user interaction
yes - max time kernel
75s - max time network
76s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 19:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/JAKEmodzGorillaTag/discord-nuker
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target https://github.com/JAKEmodzGorillaTag/discord-nuker
- Sample260810-xtjz6a1vfx
Malware Config
Extracted
Family
-
mercurialgrabber
C2
-
https://discord.com/api/webhooks/978410268046532618/TUMPru7pfra39OMjJKQ52TVeErWTh1DsoSwaMTVOBEfuci1wDevbAXcSYoEtO4lBCVkr
Signatures
- Family: Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions HAZARD.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions HAZARD.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 52 4628 chrome.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools HAZARD.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools HAZARD.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion HAZARD.exe - Executes dropped EXE 2 IoCs
pid Process 1004 HAZARD.exe 1036 HAZARD.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 74 discord.com 75 discord.com 76 discord.com 78 raw.githubusercontent.com 91 discord.com 50 raw.githubusercontent.com 52 raw.githubusercontent.com - Looks up external IP address via web service 1 TTPs 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 67 ip4.seeip.org 68 ip4.seeip.org 69 ip4.seeip.org 72 ip-api.com 77 ip4.seeip.org 86 ip4.seeip.org 89 ip-api.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum HAZARD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 HAZARD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum HAZARD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 HAZARD.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4628 chrome.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S HAZARD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S HAZARD.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HAZARD.exe - Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer HAZARD.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer HAZARD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName HAZARD.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308625333187560" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 564 chrome.exe 564 chrome.exe 564 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeDebugPrivilege 1004 HAZARD.exe Token: SeShutdownPrivilege 564 chrome.exe Token: SeCreatePagefilePrivilege 564 chrome.exe Token: SeShutdownPrivilege 564 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe 564 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 564 wrote to memory of 2472 564 chrome.exe 86 PID 564 wrote to memory of 4628 564 chrome.exe 87 PID 564 wrote to memory of 536 564 chrome.exe 88 PID 564 wrote to memory of 536 564 chrome.exe 88 PID 564 wrote to memory of 2072 564 chrome.exe 89 PID 564 wrote to memory of 2072 564 chrome.exe 89 PID 564 wrote to memory of 2108 564 chrome.exe 90 PID 564 wrote to memory of 4620 564 chrome.exe 91 PID 564 wrote to memory of 2108 564 chrome.exe 90 PID 564 wrote to memory of 4620 564 chrome.exe 91 PID 564 wrote to memory of 4212 564 chrome.exe 93 PID 564 wrote to memory of 4212 564 chrome.exe 93 PID 564 wrote to memory of 1412 564 chrome.exe 96 PID 564 wrote to memory of 4948 564 chrome.exe 99 PID 564 wrote to memory of 2912 564 chrome.exe 104 PID 564 wrote to memory of 4712 564 chrome.exe 105 PID 564 wrote to memory of 1892 564 chrome.exe 106
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/JAKEmodzGorillaTag/discord-nuker1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd5dadc728,0x7ffd5dadc734,0x7ffd5dadc7402⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,12448201385343186297,3420045540438532503,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,6058732010272134908,15711451826592228136,262144 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,10735750575021211048,5391822479256437231,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,10078901051024602337,2699262089342175703,2097152 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,2686669437248763723,17668450077194243140,2097152 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,6144933105360800562,16351955981244916214,2097152 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:22⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,6265731606895005189,7888332077943021660,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,15820388772606926385,226347841561222898,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,1652943679461483129,17340364805957718499,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:82⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,6673032850384831168,8799648080872978949,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,14471903780789071363,15882706655389479686,524288 --field-trial-handle=2076,i,10004458668348620435,1949122155754960553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4576
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1160
-
C:\Users\Admin\Downloads\HAZARD.exe"C:\Users\Admin\Downloads\HAZARD.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
C:\Users\Admin\Downloads\HAZARD.exe"C:\Users\Admin\Downloads\HAZARD.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:1036
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 fd481084e74f53df2c7d5a4e51c8dce19b0854c5b4b736b4e232a02b0d585b19
- MD5 5afa366b7b8ec192b7e133bacddf4a97
- SHA1 ff50dcb650851ace19ecef2ca514e67912c39559
- SHA512 f8fc1e5fc150b89f340b17d8eec60bdc355e94848935f55602db1059ff4e86555f222eb1b3084d3144b44c063db7909bfa0f4ea9e4d1ebef3e786daecad9422f
- TLSH T17DE02BA9C921EC375CFD472D90544A49DA11135B2B60899F3B3CA1088FB06A706C5C6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 19a48e4fcd5c25374c9886869a5c3f094a226138d26fc0638fbc838c40237be6
- MD5 f034c117b9a8f78b2867e14a6f80a371
- SHA1 9eccb70ef3ec243acd9e8909ae47416572da9046
- SHA512 b55e5ce26db5b922252d988248e9fa8aac494c8b8aeb2d0fbe868cd25b8353ec6dda7768d9b17fd45e91d31f3a9d856c3a35bf5069be770ec4e971330ceb27e3
- TLSH T1BA41420064C94994CF5C16736FE6B36577305A4156534F874358DC3157DBFA748D2744
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 ca5969e6efc1afd4dff3017e1a427d2f88c2b073790860ea77cfbc7990c0f794
- MD5 361dd48fb5dbb40d71c779625fa389eb
- SHA1 d75a30305e5643e9b8f7591a76af39c3f0877c5e
- SHA512 19c9a0c675fd4f5d9b97e0f0648e03973a55607b25c0cfc69d8bd68a2438386cf6441b4145995f8b480313067d7e6af4cccdfddb2959871e819b019abee1a0de
- TLSH T1406199F783F5996D8A1196F0EA14AE1FCE680624431C387688E47E5B93E3872E14174F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 aa60866911c5e0169177ec1cbe60589d3f9c1c4b77f6a81f5f02a993f1601f64
- MD5 e1e45fb5bc12947c10b37f9a6bad9e2b
- SHA1 b3a2bb7230642f4c271adf5ffc05f4b0525afd65
- SHA512 1ac02558f5cc5d1cb88c0190a56fe41c0ac1101d1a075ae5d27b3234663ad35b0148bd830517174569dc943f670b73a2becdd50d227a68d5dd17ae68ed505d39
- SSDEEP 192:IRjO+vMigAW8Lo4v7ApAPRp2aou9qHsb+WNnmS2k12Qk2Jgokw5VyIsnAUge:IRjO+vfgAokkUXhkwTL2p2J3/e
- TLSH T1B542C82AEE146D7B9CDAD226F9167B23E7F5103631902EC4E6FC9A2C15E75CC2227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 134bfbbcf9985b57aa0d70b9a99d92e52c01880f3376fa9a05c73876c364db9a
- MD5 8156a06a45c0aab4c9525d8ed1177ffd
- SHA1 cf23c63ad3ba28a53ca1c9fc6a589d0a0aeaf070
- SHA512 dcb33f778f2e18b208380bec60c72341caed394e9832728730c9181515103ed964993ba96e24dda46841617f2476a4fa653bb454a091beb138ec11908805cf18
- SSDEEP 192:IRjO+vMigAW8Loyv7ApAPRp2aou9qHsb+WNnmS2k12Qk2Jgokw5VyIsnAUge:IRjO+vfgAoekUXhkwTL2p2J3/e
- TLSH T18342C82AEE146D7B9CDAD226F9167B23E7F5103621902EC4E6FC9A2C15E75CC2227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 4a3da9543cc95b6d9147a3ca989d0e9691629ca6317b8d6bf61c9001a781e64d
- MD5 2c2d4b75eacff972a1a62d38b84f830b
- SHA1 a383c0123f00d80df47769ea8f09797a1a9630ba
- SHA512 3345f7db28cd42be64ddb98afa5ddeaacdd7092702ed2bafa49e1932629a586ac2ddbc6c9c46599cc67cdf3316a86963212072a442b95e4c2daf594d76cf86f0
- TLSH T1D2B01200C0026241C84602B01142188C7214AF10D60A170543E46D26CD269A18014050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585290.TMP
- Size 96B
- SHA256 3a162ec79fadd9e8cee5d1ef2d519c0c9312ef03988bb61e84ac3266473efa15
- MD5 270eaa3204b9bb85902e85c0cb8997da
- SHA1 63de8bf5330f210d538f608b021ff9f2163a9837
- SHA512 e17af0aefdd58da57f3c8b4f7ef614a65a337af30f0452d7a802e75fe33a29bc56566bafb04ab650c011216a51d1270a4700a84e04edd281927e17bff4a79d84
- TLSH T121B02280C002B302C00303B0288C88FE3230CF20C303230382E00E32CC20AB00820020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d10a787765540c979dfecb13e938227e9d4cd28a3f6d3bf3953d3bf306f7ac47
- MD5 64052598131c4b66014000d0c4aa80e2
- SHA1 17755e06b17687a66a8fa484f8e4b9901eebe2ba
- SHA512 be3228a4549b5cb84a2407c4300396e789d547c3e73698d1d158eb06acc936bffd7615f9649790a366769990378df13ef026f776264bd3f72af09a67fc9fc7a1
- SSDEEP 3072:YnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:1m7Rkm1tYpBeh2BAog
- TLSH T1A8C3023B9D75AC3759B9FB0FA04E0A1F1DF249A7C920DE56C8D86A0423F97CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 28301762f42f180bcd52b336c2fd9ab9f0b8935b93ddaef8cbde5d504bb78bea
- MD5 64b15bf1917e71bd2de43f061ead2958
- SHA1 8493bc2e7f1abe2e1e1c56442df1a053bc890b1d
- SHA512 ffbbeac6fd73890b88537ea86b1ebc4215e4b35fdf0f75d2c205195d07627324a6132baca971773f3cf8cbfc84edc624a27195f4c99bb9db4a1a5da0a00e6424
- SSDEEP 3072:AfGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:xm7Rkm1tYpBeh2BAog
- TLSH T123C3023B5D75EC3B5CB5A74EB48E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b51f606d740f36b62c055da859c42bbdcbeace0155fdb41a3000dd1873eacacd
- MD5 daaa0a621379bd61a4112ef1921045f1
- SHA1 9d3c7902a5b6f6915c0ee56f4cebea3d1b826df5
- SHA512 fd7d46c5277b8c444dd57312118569a3b16b3d0fa39f58d66a9dcb011e7cbde29d4ebe9e7378b283c9a56a8b9808632d17b33a602219b1f818aad89cffb20f92
- SSDEEP 3072:F6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:rm7Rkm1tYpBeh2BAog
- TLSH T167C3123B5D74EC375DB5A71EA08E0B1F1EF249A7C920DE92C8D86B0423E97CD0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 45ba6130accfd0f89766ea613ed9c16b4dccc9aed0717b04e13b69ed5887b17c
- MD5 c6a552797757c23f0c562e813ccd4735
- SHA1 2b76962586c35e669873d14739a7be0101f2c0f0
- SHA512 af75ec2a93e03a1e69079486f89b8d5ab804153d65852335b6bae4fdebb5cc4a0f4ff05391ab4bac5bef8ee299002d979b5341a4cad0438a6abda4b9288dcb10
- SSDEEP 3072:Y6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:wm7Rkm1tYpBeh2BAog
- TLSH T11EC3023B5D74EC3759B5A71EA08E0A1F1EF249A7C920DE92C8D86B0423E97CD0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\HAZARD.exe
- Size 54KB
- SHA256 f97553898816caadde0f06fd0eb5b48710f298b17cb9c38c869fcd4ab6361d07
- MD5 56d648ca8c18ef15c5d4bc7bea91dd20
- SHA1 022f44db5e27e8fc2f2771ef09bf04ea7e222a56
- SHA512 3f04fe5110b00f66deb111a41107233fb12dbb84bc781df93b6a1124bd8bb91d4328e925df6d33b4a987f6b745ca76b8195945d3fd9725509d2cd61b97d25835
- SSDEEP 768:Gy6SBZ6aVopDtsVuZJLUu7TjqaKZKfgm3Eh2mTkJU6MPwT+G6WXF3pmqZ:G21VoPs0LV7TGaF7EomT+yPk+h+FX
- TLSH T142434809BBEC5609F3FE4BB96CB255144BB6B867AC32E74E5994589C0833B808850F73
- MD5 SHA1 SHA512 SSDEEP TLSH