hxxps://maps[.]app[.]goo[.]gl/cegCcK4Mm1H6wVXQ6

Analysis

user interaction
yes
max time kernel
299s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://maps.app.goo.gl/cegCcK4Mm1H6wVXQ6
Sample260909-kdaqbsdn31

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334161321869562"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{802DE5F2-083C-4190-AF6E-16D82FED9AD4}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
4068	chrome.exe
4068	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2060	2168	chrome.exe	87
PID 2168 wrote to memory of 2672	2168	chrome.exe	88
PID 2168 wrote to memory of 2672	2168	chrome.exe	88
PID 2168 wrote to memory of 4988	2168	chrome.exe	89
PID 2168 wrote to memory of 3832	2168	chrome.exe	90
PID 2168 wrote to memory of 3832	2168	chrome.exe	90
PID 2168 wrote to memory of 4448	2168	chrome.exe	91
PID 2168 wrote to memory of 4180	2168	chrome.exe	92
PID 2168 wrote to memory of 4448	2168	chrome.exe	91
PID 2168 wrote to memory of 4180	2168	chrome.exe	92
PID 2168 wrote to memory of 4432	2168	chrome.exe	94
PID 2168 wrote to memory of 4432	2168	chrome.exe	94
PID 2168 wrote to memory of 4188	2168	chrome.exe	95
PID 2168 wrote to memory of 4188	2168	chrome.exe	95
PID 2168 wrote to memory of 1836	2168	chrome.exe	98
PID 2168 wrote to memory of 4644	2168	chrome.exe	105
PID 2168 wrote to memory of 3580	2168	chrome.exe	106
PID 2168 wrote to memory of 3580	2168	chrome.exe	106
PID 2168 wrote to memory of 3164	2168	chrome.exe	108
PID 2168 wrote to memory of 2648	2168	chrome.exe	109
PID 2168 wrote to memory of 4308	2168	chrome.exe	110
PID 2168 wrote to memory of 4068	2168	chrome.exe	112
PID 2168 wrote to memory of 976	2168	chrome.exe	113
PID 2168 wrote to memory of 976	2168	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://maps.app.goo.gl/cegCcK4Mm1H6wVXQ6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaf72bc728,0x7ffaf72bc734,0x7ffaf72bc740
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17551306354776522666,8852241283831389722,262144 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,5160738583796428979,9753210670042998061,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,10321509257301366813,3511332505617732269,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,4212331058903573594,14353834755154654491,2097152 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,15296964298935645211,15785639717107035663,2097152 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,6565048177442644938,6898736804340663587,2097152 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4412,i,14587301754187543510,7756930005378650242,2097152 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,1323082181378602266,11657738410470611913,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,16488154640901387546,1358575435710878423,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,10931977684202154782,14012165192661818513,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,14528540983914925691,4038172177346924980,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,13904955789304961091,3203324073653529151,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,15050061551803394533,3489441924150424197,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5884,i,13343271455879653243,698839129245070772,262144 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3040,i,14032092836171863591,16505222272242018913,524288 --field-trial-handle=1992,i,16195442532487754039,10441353099398447236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7650c782-71e2-4c93-b9c9-4b45c0f775c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7650c782-71e2-4c93-b9c9-4b45c0f775c5.tmp
Size 12KB
SHA256 16eed3f947866f9a0c45f488816bcc8cd5082ca0c9c175128537e200d9efd600
MD5 3a8d4285c6daa23077a0c4d0710004d5
SHA1 97d4e57aa41ebe6f6548659a44a2a5af88ea4270
SHA512 c558f7c6a40c5001d205c9bf5fcf8f96de5cd7e222da7a96796c1c2dc463ea0bdb4b798f2f4435eb6ed6fbffebb1530af278b2c5dddf572eae9d366adc722154
SSDEEP 192:4R1/rFbmMltv7cpAPRp2qepAi9BHsb+WNnd3in724teMu7gfevVyIsnAUge:4R1/Rb1NwUXlsrwhq2Gu7g2Je
TLSH
T18F42E82AE960757B4DDBD229F9267B63F7F5102225D42D80EAFC892C18E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 356343da19c2a370b594ab7933ca4e5d250606ea80aa364edfcd7de4aedf08d4
MD5 29c5365ff836489f30f03ca6063e9c74
SHA1 f713311aac3df1cceb21241dad1d454ad029f373
SHA512 35ad76c103f50e728d6bc1347c017c405a2ead4bc8e3a2cc6b874cc82d86d5a61e19d79f146df250bcbd89d573fe543d9431a16b3f8cc89977dd40f934710f38
TLSH
T10FE02BADC832AC2708FA1B2C20144646E74013173F91C84F3A3E920D8FB5A7A8167C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 6ecaade4d899b767ed4f7215c4b4cf41b5dfe3957911658a72686542406a6595
MD5 0b50ccaeb8f758d88dca5dd3cc309b64
SHA1 843059de5ca988b392f268eb6a0ad12a0c3d1698
SHA512 a8d6be992df3ca4bb3ec9381ebc9ebf2b2b1b5ad7e3f63e854d310aef271b4e76b8d13964f4f147de59d4957b01558c3f3c1eb0ea5318021be10617f1663f819
TLSH
T11DF02BD1AA9525B5CBDC167128C3344F29804299C7E81F09D455D1699B6197E7188E03
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 1edd4bc42355383f9dd2fac9d94bfa60ce875b11e358048e79342b6f503fd5bb
MD5 43ddfc5fdd402f1e603744b21fbfb51a
SHA1 6bee95399d21519fd3b392fb47a71a55f1896063
SHA512 ae8972dcecd9b026781c27a4f2c3aa4eb57e8740f053d06d2438316d6f26d5777216a1c3d4812e9c837f7de63ca132e315c98e1c2d0e9f6fd7d8d958fa4d6fc7
SSDEEP 192:DCAE/Gkz78Omn/spaIaEdbJXJZJQJcJeJrJmJlJRJoJwLJJAJBJ+JY5JKJW2JE:DCAE/Gkz78O+/spaIaEd1ZLOS0lcvDGd
TLSH
T178F1CCF7C3D9822DC91156F497126F1FCE2A0A24532C3C26C8E9BE5B93E2871E11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 84628b3da366117b22f952442b0cc0aaffba5d34197c19a07da47d8500e11200
MD5 b57016201ddc7aa7a218dadcb2ca4072
SHA1 1aea9c385410be8a6969c36e79f5b5ba5e61d7db
SHA512 380d0b904d1f83d4290693a94a0a92ee5d87fffecd60b648e8bcbd531ee8054e403edfa03acb87c69ce5e5a741479e7b0e51b44425666d879999a01687eae23a
SSDEEP 192:DCAE/Gkz78Omn/sR2ZaIaEdbJXJZJQJcJeJrJmJlJRJoJwLJJAJBJ+JY5JKJpNuK:DCAE/Gkz78O+/sR2ZaIaEd1ZLOS0lcvJ
TLSH
T19812BCF7C3D9822DC91156F497166F1ECE2A0A28432C3C26C8E9BE5B93E2871E11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1edef22c9ecbc5b2cc92b8a380db9de52b9c98be77a897a8e8a65ca8c6cd251c
MD5 c32db3d0ae12d43520283d5bc797dcf9
SHA1 7fab0ff026366f3c61c8203a689dc77e811f86d5
SHA512 0b6fbb8fafd73bfdb12ba2a29bc250f88fcfd465b43aa0b6864ee1bf8c4f0e9b23d7477f97a07401dbaadd0bea98c231c5ee13361d4b68756ca6f8f691f8f787
SSDEEP 192:4R1/mFbmMl+v7Up5PRpFqA5wolv19BHsb+WNRId3izHeAWteMu7gfkvVyIsnAUgE:4R1/Mb16gHXoy9rwKSeAYu7gcJE
TLSH
T18052C62BA964257B8DD6D325F9267B67E7F5202225D02D80EAFC892C18E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 709f2c8639f9b73d8cc8701c58a100df30b40673b163634c9cde6fdb05c69cac
MD5 e4489a352855d0ed03483434e34f1058
SHA1 4ca9cd2b63843d7411d5b06df3634db409914c75
SHA512 a9916951981b089d98c845e808b6e73732a41315f0d9f24d18eed17776a10089575cb187de4be08d0bfcd07df2c89ddf3bd88c52637bc59879624eecac6d80cd
SSDEEP 192:4R1/rFbmMltv7UpAPRp2qA5wolv19BHsb+WNRId3izHeEteMu7gfevVyIsnAUge:4R1/Rb1NgUXly9rwKSeKu7g2Je
TLSH
T14952C52BA964357B4DD6C225F926BB67E7F5102625D02D80EAFC892C18E7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f5231ebf8cdb6072ed19db35dc78525c19435f574175b13517f22cd8baef5954
MD5 1bff71ab119f46bf4b86bb21e633b980
SHA1 660b32ad7bc46646982ead9cb561f2dd22a2cea6
SHA512 b216b901acec4fd142b273c894b28110caf8bdbf84fb3688be68873cfca6e211bf5ee85dec31d36eba6645e6653e82e5f230ccf2894d5c25fa5618dfff65b1a0
SSDEEP 192:4R1/rFbmMl+v7UpAPRp2qA5wolv19BHsb+WNRId3izHe6teMu7gfYvVyIsnAUgE:4R1/Rb16gUXly9rwKSeEu7gAJE
TLSH
T16852C62BA960357B4DD6D325F9267B67E7F5102225D02D80EAFC893C18E7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\d4cee703-50b7-4e3d-8a29-b4e96856302b\index-dir\the-real-index
Size 72B
SHA256 33f93052774c0374dff99c4fb787703cfccd3cb9a52a5383677e86b07a32ff0d
MD5 e630bef5c6ba6a9da461512fc996c45f
SHA1 10f0ec2342103d858615813b2a4f24b076b1d974
SHA512 3e246c21bc737ce66adb35c22d31e4de469da82daaec5e6868c4d3d039e0338aa0fe9ddaeb5e792ce42d5a1a8587b1b9a6df2e37f18a6f70309e264d7ec84a08
TLSH
T1A7A0027245561025C9C927B0565699742314482043C602065A9C5695D9563554131834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590575.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\d4cee703-50b7-4e3d-8a29-b4e96856302b\index-dir\the-real-index~RFe590575.TMP
Size 48B
SHA256 1010932b542251c2d0fb4bfe394d82f9a95c0c80721d1351076bf1f162c62004
MD5 9b210327ea8a1a48de6f9e088d3065d9
SHA1 0b27971d29ab818aa5885ec5391a8fc84f2c5a4b
SHA512 3b541cf4970d7321473cbab5cf5611c0571099686d12ff925f763f8be50227ed06fc0a113260b91d6edde81efc70c94e470f6ea07c898e153030047ddf8d8178
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt
Size 141B
SHA256 687338aca7f5a39e660ad143b7a54a183599487dd3cefa8e364bc6b886bf9c6f
MD5 25bfb3f83d4e491e78f6aa3b01bef805
SHA1 88decaf90f6cfac0593267c71ab1979e341fd70e
SHA512 bd4802958f2f54f10487e081be589de7e35d500db381d81c7eb896f41b2ad56235bfa49c7baf5a5fe7e43088472dd0e63a2e8937b61cc6769fb11d0f66bbe3c7
TLSH
T1D2C02BFB84117000EE90D3C13530540DC4328EC68C0C44E4C045F0C3127114300419A0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt
Size 135B
SHA256 0f96d30a9ea9de75373b0a74fa72ec2e43c52ddd25764f32522848484667ab18
MD5 5a832bdcbb899fb7ce6514cea8b02e9d
SHA1 03823d91eddfd706dff113be4bdb0393878eb941
SHA512 daffa924f844345426f22ada9e0692386f41681d604e47a4c8ea78b8523158c396096f68c4c7f9c40c578328855454588d0acf9cf77dafa8293d3eaa4ed06216
TLSH
T1A2C02BFB8411A000DDA0D3C03520541C843296C6881C44D0C04490C3124114300439A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 0b76ddfb2ead0524025c71a3c267c7cee280a886a7e24a51ca08a85f1f93de89
MD5 0dd87f22de36d7ee2bf394ef69263c18
SHA1 155263db6a595cfb3be74129c71a61a5e8b99236
SHA512 6ccbf19d50a2cb38cd74d5d48af777475128c14a91318db58040fba563ec747c38b39c4ab8e2caebe3c3a5d125bef10b8e3e9ac21c3eb84d287ab5564ec9f497
TLSH
T101C02200C2002200C08B03B08A20A8CCB200AAA8CB0A232002A0280BE8BA230800A002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590517.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590517.TMP
Size 96B
SHA256 9567d6e9734a01618d1eefc7cde2777c47953dfd63d59e03b0f7540f94286d5f
MD5 10830acb7ba7934826d402a5d9701942
SHA1 450176b47db14466aece93033f79f144d89cfc78
SHA512 92ad3e751668f6fc965525af4990ba5b7fbfe26cdabff1f97de3006b2b7bfc576bb114c113e92c7c52b8ba6f1f9a7c077c37f023d7a0bf825b3732fb48e16a1a
TLSH
T110B00295E2026312C4D603B02A9596D871A0DF2AC643121696F45E76DEA6A605625560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 c16966fb6a3ea4d5341bba998a5ce7001b62766e451ac2af199d0e42068816bc
MD5 5f10c0b801c216cb200523c1a816c6c5
SHA1 56ee09c35030d285dc93c36f5cacfa5caa23f8c0
SHA512 517ea8e154860a3b8493afe07343ec0096d89ccd38243087e80faf753ec53fa85cdece4dbd0801a3c4dccfb23993362eef33fe664ae21d055be79cd71104acac
SSDEEP 3072:SqIFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:7IFmUi21rSm8uUVNSlzY/
TLSH
T185C31210B9A7F8B3EE8931447ADF2A149D6C0E418291C50196739D415DEF3CA6FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 99f6c2396db503ae3f51ab8ce07af8a3e9949a5cbf1a45010da5832941852bdf
MD5 165a37a4c78a33cd5ddde3926cc39a97
SHA1 e07537cb187055a015e9903c79c484b579a4742e
SHA512 f70817c71d62bc17e0475091756d49df840bb2593ca351b16895a05ef33ef09ed135f92eb3da755cfba7edd7f1882de3d8078b7c2ae8d97dc2c7dc02ad0be18e
SSDEEP 3072:SCIFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:7IFmUi21rSm8uUVNSlzY/
TLSH
T16FC31210B9A7F8B3EE8931447BDF2A149DAC0E418291C50196739D415DEF3CA6FAAF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2e7717907fd1d130a28b6dbea3cc4e3a4d44ed9fd7da415aa52a4d5889302479
MD5 a2ba56d83246ae18aaf6226cc8a1af0d
SHA1 cdc01584c3c893a443d59e1a690b125eceb1c8c3
SHA512 9e829bad60503ce9ae04f6a2f45a438586da9f7e500b47490826ae995e322c94e5b72a420c21b1167d63dfbd83915f611a20760fb713e13d5b3bf7822e3e9ee0
SSDEEP 3072:SkFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:5FmUi21rSm8uUVNSlzY/
TLSH
T199C31300BAE3F8F2EE5930447BEE2A145D6C0D818191C6415273AD419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 85771ef38c9b7d99b2a966454b3a33651245e15f5afe744b3aaa1ee759bc5216
MD5 4456de0f9a1d4f406cc5d33ab778410e
SHA1 4e1f5d8c872d674aac66dc8edd5e6a49b85076b7
SHA512 a80123a4711b5406ac3b8bc97e9ed870c8c929f78963ae535eb81d6d83db97e28e0d11c3d472a10ff698d5dcf4d8c43ddac5e6482dc0a960eda1f42aef59fbd7
SSDEEP 3072:S/FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:QFmUi21rSm8uUVNSlzY/
TLSH
T104C31300B9E7F8B3EF99304476EE2A159D680E818191C54157739E419DEF3CA1FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a165b03d2e1bcf5c9de94a481a568a88565101756da1f6464b8a2c8da89eed90
MD5 c1416c6087de5bf53604dfda29817159
SHA1 23472f0c7b299266481e03fffa85b9e84cb44bf3
SHA512 390acf47a5cce02fda582732c5fb0ae3c354123be30524785cfa00f5150fbbefb465794688a600b2efe09fe144904f8795372a990aa8bb7951eea30108848981
SSDEEP 3072:S2FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:/FmUi21rSm8uUVNSlzY/
TLSH
T15AC31300B9E7F8B3EF99304476EE2A159D680E818191C50153739E419DEF3CA1FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download