1e86b5b9ca8c69b5dbacf926043310b3d3ea1329e7a7b5e743cae3b81cc72267

Analysis

user interaction
yes
max time kernel
88s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.4MB
Sample260817-31ab7aec99
SHA256 1e86b5b9ca8c69b5dbacf926043310b3d3ea1329e7a7b5e743cae3b81cc72267
MD5 11dddd9f6d21320b63b21ad28a4dc436
SHA1 4a9072548dcd5afdc5de6f506f0b653acaf5eea1
SHA512 538165dc28614457db48be11e9b43870ea19a802f80d2fb409c0377ad9ac41512ae6738e1fcacdf933be76aba652901f6d57b3bcd1e45df9cc15fd86301a3c73
SSDEEP 24576:9R8MxyPjGWLdZwa/34DQy1QCQP1/j8q/1kGBBTy+6gE3vJ+KOMmkXY3kpiDn63:/8Mxy7GWLdZwomCh5wJ+KOMmkXCDn6
TLSH
T13F65BF87F3E266ACC127A13DC1A2D267DE323D08133582DF6786AB11A7475E09E752C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4072	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314847279777598"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4128	Loader.exe
4128	Loader.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4128	Loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4128	Loader.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1104	3452	chrome.exe	94
PID 3452 wrote to memory of 4052	3452	chrome.exe	95
PID 3452 wrote to memory of 4052	3452	chrome.exe	95
PID 3452 wrote to memory of 4072	3452	chrome.exe	96
PID 3452 wrote to memory of 4720	3452	chrome.exe	97
PID 3452 wrote to memory of 4720	3452	chrome.exe	97
PID 3452 wrote to memory of 3832	3452	chrome.exe	99
PID 3452 wrote to memory of 2284	3452	chrome.exe	100
PID 3452 wrote to memory of 3832	3452	chrome.exe	99
PID 3452 wrote to memory of 2284	3452	chrome.exe	100
PID 3452 wrote to memory of 2108	3452	chrome.exe	101
PID 3452 wrote to memory of 2108	3452	chrome.exe	101
PID 3452 wrote to memory of 2524	3452	chrome.exe	102
PID 3452 wrote to memory of 2524	3452	chrome.exe	102
PID 3452 wrote to memory of 1812	3452	chrome.exe	103
PID 3452 wrote to memory of 532	3452	chrome.exe	105
PID 3452 wrote to memory of 532	3452	chrome.exe	105
PID 3452 wrote to memory of 4944	3452	chrome.exe	108
PID 3452 wrote to memory of 4576	3452	chrome.exe	109
PID 3452 wrote to memory of 1240	3452	chrome.exe	110
PID 3452 wrote to memory of 2756	3452	chrome.exe	111
PID 3452 wrote to memory of 2756	3452	chrome.exe	111
PID 3452 wrote to memory of 1244	3452	chrome.exe	112
PID 3452 wrote to memory of 1244	3452	chrome.exe	112
PID 3452 wrote to memory of 2220	3452	chrome.exe	113
PID 3452 wrote to memory of 2220	3452	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc8cfbc728,0x7ffc8cfbc734,0x7ffc8cfbc740
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,6096228678847327254,1668781703093260713,262144 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,14518487205597315876,8411729394627667952,524288 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,17058596598051813066,1432512807991602878,524288 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,3880726829866301559,8002339362872724683,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,2856707240702508985,1385408985640751157,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,361129553233903406,3062442513741592357,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,5478247202640104064,4376444198743048565,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,8010171723539455350,86515211628644781,524288 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,12403762377072567085,17885714016777641692,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3288,i,1913364079192980784,10014101499107829229,524288 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,336667789896540733,3627684123353035577,524288 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,8223928374853873026,5220841247444151963,524288 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4564,i,16014937374190258272,10572727868002243990,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4640,i,7032101920234206078,12954394984853052836,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4836,i,10699286229902244355,8522366302709382290,2097152 --field-trial-handle=2020,i,11112431691674019033,7282836687663886846,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:2220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

984eb0ca-dac9-4841-be71-211290d310d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\984eb0ca-dac9-4841-be71-211290d310d9.tmp
Size 12KB
SHA256 e5132ff046dad533cc7a3a7290a6b38baed0a2c0f9037c63d8de80990f5a69fe
MD5 b444db3830a2639bcfbfc59c9f03d270
SHA1 c0444928b6910265eff02021b674a5e05f8dae3e
SHA512 6ec0549aa6d2ae8002f1228f03e96454dd1a2eed57cab8df67cf39a80cb6b46a8838e5c70e17c201aaa38d9b9ada43a35ce6bb8e89b51080d24f44f3c5ef432c
SSDEEP 192:SRO81pS8D4v72ymhAPRp2V+95Hsb+WNnzo4Ub28kHV02SbejeaLVyIsnAUgtaJ:SRO8f3kQ8Xp7wsL2VHV02SJaN8
TLSH
T1E742D62EB920747B9DDBD229F9223757D7F5112225842E84FAFC8A2C15E76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d4eabe46bf90404a3f59806dada096f3189906418f50f2a4f2720e097bad5df2
MD5 442c171759f0dea543e130fc84225203
SHA1 a21b7563bfb018d3ac373a32004c5c0345c6faeb
SHA512 aeea23a9795f7d401a80f93585546f57b4a70d7207ba894c1a4a859a6342ffbfb573190bb9f59b1a316d1ea390136b55ea0cf75e5c214818691e73be578e84b3
TLSH
T165E02BA9C920BD3F0DFD271964580A46E754235B2B40855B7A3C970D8FB96772586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 2cd99ac2f0997020c681d33db83c9e420145fbdad741816dc1bc4252b043f52d
MD5 8796a0050e0b3a4c93a192449dd643a4
SHA1 0e3c3e3e830fd707fefaa659814e3015c1caea41
SHA512 137e59f1bc186e50a64992c8779bcf8a7f0409564d06f1543d641b35e1ed541648a1e277be54aaa7371a432d9a6ae569c64f6b505d7ff1c63f15d4bd4bdafc04
TLSH
T176C02B5401F24011C3B431F4242C7CC011500DB44C90E3069C7CCFCFB83B1D10000220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 cf7dff4e307a5c910767fdcf6b42eb26391af496ab6832733e172a1ce208ff83
MD5 c656bfdd0833eac53c0dc7aeb3513a60
SHA1 bfd04e1d688be5b57af1fe30707dcc990896d261
SHA512 9cf3672d137fb1877005895baeffa4a8b93317049e03a3afa5ee700b3238d1e139757691d5769c04018a20a91b6b65534a761632e8caf930d7ac780a97c039a1
TLSH
T1D5C0921401E29422E3E832B422AA60C035F40AB48EE2D666DAACD8DAD87B6A29105850
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c33361d7984baa31c6637caaefb2c86dda8cc8723e482742ac911659db3649bf
MD5 cd819dd9bf54425eb521610015ba000e
SHA1 438b6c98797d5b62dcfdfad7108746e0e0a5185d
SHA512 11f09f46fa29fcf31107e4a1a48ade09e955b2183cc3b99d2576d1961510b8ce79f557d24da8203f54ac7d2e119b45705586f6f0938ce778187bfa12efc11dd7
TLSH
T18E818BF7D3E8C62D891156F49B25BE2FCE290A24531C3C6688D4BE5B53F2872D21538E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 6e30b7ead712968ec59a0d1f757356ab05d2bc87d81c1c6cc7054cfabf6f9896
MD5 9cdffe379ce4e38b2fd1b95fe31eed84
SHA1 f56b84b8fa58d1ddf1519de5d81fa2d231028d5d
SHA512 ecc78cb925abc5509df62fef7b3c632424a65df70be630f022a46ce9d43e29d43e7b28bba01084bbfa237333ac8091f520f7e0e98883f78d84001b039ba98caa
TLSH
T114F0505B967D743320BD46A71D04BC4A54BA983006907DE4CE6A412DD0910E70B15463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0cbe84b15d35241a22470d33f6155aa52fc9fc153c11e4321ccaf8ea60d968cf
MD5 abfd4a49cd747a767aa19cc36db7c2e3
SHA1 d34288f9086159b321066267b7af0ac18b4474ef
SHA512 14c7cf4fedaf6ec6d827003529a2ef9208b002e1425f4ce4a914b14c4f4364aa27c683bab8e6e7ebf79b69fd7d2a1eaae9a5de08f5ee2647f977e8819f97d4c8
SSDEEP 192:7RO81pS8D4v72ymhKPRp2MWc95Hsb+WNiGv0BgvgukHV02Sbejea2VyIsnAUgraJ:7RO8f3kQaX17wCugHHV02SJaOe
TLSH
T16352E82EB920797B9DD7E329F9127757D7F5102125902E84FAFC8A2C15E76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 560b15641ae6e081ff15c415aa9b6a4f8ddae67f9bd5cd33750de29a98d7fc9d
MD5 a4261e937caa9107ba108723423316cc
SHA1 8e50bf7892ad0ec14ba6731cd289d690c45df985
SHA512 7708529f567af446224cba920c2e3683bf4eb408c50077434532bb336a388e079234eb5c10ab0669b3e015beb0f36bbe2522083e8d4c54084c2b642fd666cce2
TLSH
T121B01241C001A201C05302F02343248872585F20970A2B0143E0A922C82A9618424150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae8b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae8b.TMP
Size 96B
SHA256 e0b2690ae6b2c33fd34fbf85806a2c74b464201b5825078ec9fb3e0551c38550
MD5 4c2b866cafd8d0086f11af0ac63ba214
SHA1 5ec40a3c712186d104e8719aa0980be85e7ed15e
SHA512 be742eb434173a358d460e9a6d03bb88241f9e162cbf01478d423189b29e96deb0d4e7f6cc9b9da20e4a4deb6be7a750c5e68d4c73e74e9401881e484296d143
TLSH
T106B022C0C2032202C00223B03083E0C83320CF2ACB03030283E00EAAEC28232882A022
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 4e8bd16cc46b8fd6a9fcb213623b7d28fb9f8e2febd1a8936cb818793a565f1e
MD5 032fec26ce0f560c5d4ccd027cf85751
SHA1 dfd1f218fd9ffdafa7bc16a4adfbd772bc32c1b5
SHA512 1808a7f0341d2c683e84170187d2a73dbedc9a94afe844c47465b98f645a14633bab06c343c66e83b068794a6524804fde0b8544dc1f65b879d770530e2abf35
SSDEEP 6144:3JM+wMtlIYw99QAb/T4w7wNqZ/ZLW3Exk:3G+3tWY2cqZ/piQk
TLSH
T1983413729F471E37AF85DF28A5332B8A6BF2416681388346FA2D3BEF6C435C544064E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 302KB
SHA256 9b6f4dcb5f677c9de68bc5ea8248a2c90fbbca920bc296649080035270c8eba2
MD5 b46b2779c2d73ea96869ab11b49f50c8
SHA1 d9d591399040be28b45e8a262537c25137d12c7a
SHA512 6d209e354572303a75cd326676beb244f9ea612090a21ec61c70ab5fbccc733072d9f407eb7bf615d9a9e2f4771e97e9d2dec70c79add58e6d99ed0cd4723ae9
SSDEEP 6144:PpRjrmgk+wMtlIYw99QAb/T4w7wNqZ/ZLW3Exk:PpRjrmb+3tWY2cqZ/piQk
TLSH
T133641272DB430E769E86DB2851232B5A57F642A38138C747F76D3BDF6C4398184068F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 b9ffd8f51ed8593e7edc6375f0cceec216dad2022cda524fc6d2d2d3fee925c4
MD5 c26d50f40732907481387fa47536bb9e
SHA1 bdc2af5259f426ce64be6eed48a93e53ab7bb6da
SHA512 f9afdcc72dd0edcefb68e22b3dae81b0d3b7f40fabccc20b88b40d22c1abb4489e8ae9da211545b5370a35cce546fe16e8386de28aadfe318f07fb0a970a9e83
SSDEEP 3072:IN+dIVWUTnn0QwU2Ete7AIYw9DJQHgbWQ4048D7wNqfd7NtZL8cHQRZEQ6Spsk:I0+wMtlIYw99QAb/T4w7wNqZ/ZLW3Exk
TLSH
T1883413729F471E37AF86DF28A523278A67F2416681388346FB6D3BEF6C035C544064E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6055371f5855e83eb576ec3da70428e4fd0a2135e1c2a64e0acffebd6af67627
MD5 ff2bf37c22bca53fabbdef004a623b8e
SHA1 63bd6835fbb540f5380beee9301930fe5b5461dc
SHA512 96a90e944ad6659d121fcf67893b1f2d4a564c30d115abdc88356862cea7ccb7ca9d0633ae4c4a58b906b105587b6aedaa3cb6f09bb38a331c55e652cfb692b7
SSDEEP 1536:T/QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Wqfd7NtZL8cHQRZEQ6Spsk
TLSH
T198C30237DBC21F339D92CB60B9530FD6A7B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 4e96f25934d0860a9e5ddd29d388f15420edc3d4fa083ee724d88f6141967985
MD5 014c2853cb3e47865dd034ae578d24aa
SHA1 53b320f730ece515136187a3968e5eb3faeecd7e
SHA512 a023b0e3bd3256febaddd931f67551878e185849bfe17302d3eda99a39815f95faee10f6296cb52c39aa4aad5e999ad0c79d107b5b532e2ec0d1cf932150fcbf
SSDEEP 3072:a4+dIVWUTnn0QwU2Ete7AIYw9DJQHgbWQ4048D7wNqfd7NtZL8cHQRZEQ6Spsk:ab+wMtlIYw99QAb/T4w7wNqZ/ZLW3Exk
TLSH
T1F03412729B471E37AF86DB24A5331B8A67F2016281388346FB6D3BFF6C439C540464E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 f2f73db5ed5df1f2f49af900bf67a18f9124d47667efed4991ecf89d77bc5cd1
MD5 2fefc077521de5cfb813c7bfa6912257
SHA1 cd98a5fbec1ee2be3ea167ec404f1a464849de27
SHA512 5538cb6fb0985a6186256fa2ddf5d65e4dfd13b45ba65913daa34cea75bcac7f876a9c55047820fc340ce4a40d51a22bd4ef07402519577b60e65724abde1c64
SSDEEP 3072:f4+dIVWUTnn0QwU2Ete7AIYw9DJQHgbWQ4048D7wNqfd7NtZL8cHQRZEQ6Spsk:fb+wMtlIYw99QAb/T4w7wNqZ/ZLW3Exk
TLSH
T1153412729B471E37AF86DB24A5331B8A67F2016281388346FB6D3BFF6C439C540464E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 976981e2ea99e458fe194666db00cf526488c7df246feaf84193085461cd0aea
MD5 f5a14a6306d4e5b6bbe81af80bf786a4
SHA1 67c701d81a3969f9f109a4a7888a7e04c69cda66
SHA512 bfb6caba901631a4e19b8c7bf2778e0f7059579be8908a64e1159e21d6c3cda9ced8bd5e59eec201b51813adefec432f0ae6e8ea55ca86b4ff287157688c291e
SSDEEP 3:MsEllllkEthXllkl2zE/lhfa/l:/M/xT02z4ql
TLSH
T17D440244AB80040AC6246631C051935017B5D45016125B43385108229D856400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download