hxxps://www[.]google[.]com/goto?url=CAESYAHrOzAVkfOtEjvwzweZUEQXGzrdlv54o1rqWH-v5EccP-gdu0gqej2DeaR1mFVUL89V_I-SR3LWO9ILXqtfDKKeyOXKZMktI0OcPqhMDw11wt51K2fJeiYA2mItT-cBfg

Resubmissions

30/09/2026, 15:30

260930-sxpmlayblg3

30/09/2026, 11:02

260930-m5mv3sde643

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/goto?url=CAESYAHrOzAVkfOtEjvwzweZUEQXGzrdlv54o1rqWH-v5EccP-gdu0gqej2DeaR1mFVUL89V_I-SR3LWO9ILXqtfDKKeyOXKZMktI0OcPqhMDw11wt51K2fJeiYA2mItT-cBfg
Sample260930-sxpmlayblg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3944	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe
3324	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 3848	3324	chrome.exe	86
PID 3324 wrote to memory of 3196	3324	chrome.exe	87
PID 3324 wrote to memory of 3196	3324	chrome.exe	87
PID 3324 wrote to memory of 3944	3324	chrome.exe	88
PID 3324 wrote to memory of 3780	3324	chrome.exe	89
PID 3324 wrote to memory of 3780	3324	chrome.exe	89
PID 3324 wrote to memory of 3568	3324	chrome.exe	91
PID 3324 wrote to memory of 692	3324	chrome.exe	92
PID 3324 wrote to memory of 3568	3324	chrome.exe	91
PID 3324 wrote to memory of 692	3324	chrome.exe	92
PID 3324 wrote to memory of 4612	3324	chrome.exe	93
PID 3324 wrote to memory of 4612	3324	chrome.exe	93
PID 3324 wrote to memory of 4200	3324	chrome.exe	105
PID 3324 wrote to memory of 2836	3324	chrome.exe	111
PID 3324 wrote to memory of 2836	3324	chrome.exe	111
PID 3324 wrote to memory of 2740	3324	chrome.exe	112
PID 3324 wrote to memory of 2740	3324	chrome.exe	112
PID 3324 wrote to memory of 3396	3324	chrome.exe	113
PID 3324 wrote to memory of 3396	3324	chrome.exe	113
PID 3324 wrote to memory of 4116	3324	chrome.exe	115
PID 3324 wrote to memory of 1212	3324	chrome.exe	116
PID 3324 wrote to memory of 5072	3324	chrome.exe	117
PID 3324 wrote to memory of 4308	3324	chrome.exe	120
PID 3324 wrote to memory of 4308	3324	chrome.exe	120
PID 3324 wrote to memory of 4640	3324	chrome.exe	124
PID 3324 wrote to memory of 4656	3324	chrome.exe	125
PID 3324 wrote to memory of 4656	3324	chrome.exe	125

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/goto?url=CAESYAHrOzAVkfOtEjvwzweZUEQXGzrdlv54o1rqWH-v5EccP-gdu0gqej2DeaR1mFVUL89V_I-SR3LWO9ILXqtfDKKeyOXKZMktI0OcPqhMDw11wt51K2fJeiYA2mItT-cBfg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa41b7c728,0x7ffa41b7c734,0x7ffa41b7c740
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,17737668739642809401,6299649120476290450,262144 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1556,i,11290714276806882873,16367836719790376961,524288 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,11222574287568782920,15272341034399695503,524288 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,9165077504687024785,12632282453876298389,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,7377284613138727544,10870251825413276759,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,7165563939649709125,13867693988821558890,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,15741023819574524057,10166676155547357787,524288 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,1702583917440952282,2165030005569011145,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3244,i,2200767514779325925,11684506806908950934,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3024,i,12716670140894259762,119153255921881597,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,5794945176040096899,12658006875670451900,524288 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,10254552580736552840,3599326303412968171,524288 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,464826569798522369,12337112731449368244,524288 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5352,i,6403184434653168958,14039641265135636797,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5264,i,1574987992270247278,8785803435156710200,262144 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3960,i,11103989640590266258,6352551103819853681,2097152 --field-trial-handle=1972,i,6113376794565875842,12725078948739287700,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4fb9ead0128921f7757b78a013743054460958580906ebb5541c0560886691ff
MD5 9ae5f2f4c1b1454e1a9ce25f8cecd6d3
SHA1 b5afca15626483d1bf5b15a5c12a7da3bc8d6482
SHA512 dfef4fc3cb6bc819d4618266d7ea78a3cf35b68230b4dab41f8b7725a3b59923fd09ffbb1529ec8b24f03d572cb561cdb7c4ea7eb5c631e7731ccfeea665c237
TLSH
T141F0ACE4D822EC7B08FC072D6064474AF75013673B82488F3B3C820C4FB123B458685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a9bb834c67782a710892feaf6ca15d5c5bc01a00d12ff9378b62825702520fad
MD5 684758376941d7fb245a6b25e27c3648
SHA1 4633ed3e73d3b3a01c85dd33778f0afd36f55cca
SHA512 eb1e9976370abdf54ddb76fe5b08850e7d95bb341e9ef25f9185b7e8c291e3b751000c3e3e51780b0dd1d012b5a0a4b76d6b91501210ea2284ac3a342a1ddafe
TLSH
T146518AB7C3E8862D891156F4AB256E1FCE6D0A14532D3C56C9D8AE1B53E28B1D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 28f2c0a5f3e9bc55a721bb5f01087979608387c8562e775d8fa76361452f5ac3
MD5 cbe7109b194c4b3ae701ea074ac3b8a6
SHA1 21b7f11cad244319cdcc4221f6ff7e55dd4060a2
SHA512 6054c4fa671bf7966c91ca4b608ef562d43b139f9cf1acabd3363c9d4c18b14e559df0c4d89ea21db6dd9a533f7c8ac64bacfaf68e8c7c22fd37ddf565c5fece
TLSH
T151617CF7C3D8863D891156F4AB256E1FCE6D0A14532D3C56C9D8AE1B93E28B1E34064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3369e0978b46c8ac98563535ea25b5484acbb7a12c8cc0b182584c45f40bc237
MD5 e0910023fc8443fed671f2dd5f087e6b
SHA1 3f1b9b77ae87cc5dbcbcdb05cdee7c5d734eee1b
SHA512 1dec6d0e284a50c86e1c25993b451635c77bf1aa4e9cff9cba8e6887298bc67f93f278f700598aefc024c6e3a8fadb30c5849da02beea6c6b33ac694e9817183
SSDEEP 192:NRnq6JZYMXrv7VNDpAPRp289QHsb+WNnfcP0j8kwetMVyIsnAUge:NRnq6TZxUXDWwkPt+We
TLSH
T1C542812DBE14757F9CDBD22AFA267753D7F5102120842E88EAF9892C14E76CD2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b0bb364916e7c202a145ce7ae3dc87f0cfb3b2962e002e999ea8c881061e008
MD5 a31a79979eac1e6df64f0a8d8216f251
SHA1 30d89c99b9e4a82c1fb2ac74aa82aa46cfee89f0
SHA512 ea5d0de24e0f846f7716f9e8ca666797aa770791bd87d74c19eb096e34ea3f9f93e900fe3ea1c477c73a0f0036a3359c3ea09d2b37a33a655452f637d9bb4749
SSDEEP 192:NRnq6JZYMXSv7VNDpAPRp2AD9QHsb+WNnfcPMj8kwetTVyIsnAUgE:NRnq6+ZxUXxWwkP1+rE
TLSH
T1BB42A32DB914757F9CDBD22AFA267753D3F5102120842E88EAFD893C14E76CD2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 b494e61f07372ec9c7e51cecb31e35f7b1764c9454464712d269b67764c84218
MD5 779b83eba2269d00b677242dea1e1e0d
SHA1 4c0eeebf4312622db708a61e247a5a2a742d6b5e
SHA512 a0dafae9dea8b578fc1e281968512282b6ec5965118828fb163155216d9e94f3cdfc5a61b7a4f5636d6bb5bcc89c2c71d8f6810856f0ed434ef44469c50837c0
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3Htb5w9:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pY
TLSH
T1E562F867AC4C9E3B0FD4D649CC177A4FEDB4025621AE886482FB982503E4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 97d2cf33fa7c4f27bd9ca396e3101b22d81c9b155aaa6e7ae49c76d1bd4be034
MD5 e23684a713e514b0814e6b037355a729
SHA1 968db6c558d72c2b6ccd6e980a5c4a4b85ec8839
SHA512 aec1daa8041a7f185f5ddd2f083bd72c9602b2de29424f559ef50464a99eb41330748741d57fe51cdb1e7fb106c6c499db0b65839fcccef0dd2042674b146531
TLSH
T1D8B01244C0425306C44203F4155534883154DF10A60A175141F01D129D35251806F454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591fc3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591fc3.TMP
Size 96B
SHA256 e6000abc5faab3aced60a93307fcd326e99340af64f15ee559fdf29341c49622
MD5 0a09914422ec28f46f7542190f17b3d3
SHA1 1846df33e380f969bb63022849d46baa0a80751d
SHA512 51c10925bdd36d5062b7ad08b6caa8dabd9e8a1c57d1af05266a1057faed765ed61204d3c05046f2092833fc225a29d4c30e8fcd827ea931ce5c1311f6eb07df
TLSH
T17DB02202C0233202C00A83B0288088C830A0CF30CE0B02038AE0BAAAFCA02A00028830
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 92ce34de96c6efa4d87d472dd09ed7459c664ed41ce37fa5dbcbb02f7df373a6
MD5 7c64b7caea6a39cb3f6d80c73ee62fb6
SHA1 ac88afe8796e6a3255d1380748e2d268250f8a07
SHA512 580cec24d99d85316ce4ed7123bc8a99723a80851975d2047bc7c879ef12bba919210ab3cc424c6eb32230c5db01aa812ce267f0802b802098c061a325779b1d
SSDEEP 3072:M+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:M+hFD+7t56OD9ZfSApprr
TLSH
T1F7D30232AA95D8BBC9FD6541F147A304DD7668EE41DE3A0984465F8EA09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 be895fab259cf81027d9499005da1b2dbd921a2ac65ef8ea8068ae70f0b0d6bd
MD5 de1f8eb20ebda3a816c768cc53fcae6d
SHA1 203e1f4ce445ac3d240dcc4c8e0db08f7e7719d4
SHA512 5234f75508d95a450c1de574dd447b5b2c4960b55f6ac307a0923a150730bd9187e56ec4dd5787217bdb687ee23ce0e1d14df737a0f47d6ec97c57a04682d42c
SSDEEP 3072:M+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:M+hFD+7t56OD9ZfSApprr
TLSH
T154D30232AA95D8BBC9BD6541F157A300CD76A8ED41DE3A0984465F8EE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 b41dbc1a43f0621d713c27a2f813c8273cdd937b090910aa73ebb35f6094fc31
MD5 4ea7ad4714a586d65785ebc6348f192f
SHA1 2e9b253c187cecfaa08d5e3760141ad03867b6d7
SHA512 16323e26062090eee7fba07a8142485c83486327f9bb346a637e20acd162cd7081344f9dfe3e7efd612a8a2358d39598e5f1446d6c9eccb0ea1b4a3075f6c49c
SSDEEP 3072:3+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:3+hFD+7t56OD9ZfSApprr
TLSH
T131D31232AA95D9BBC9BC6541B157A300DD76ACED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 b33026116defd2d3da7247ead7a9e0dc129326d15aaabd7e2ae3a7d2f4b6036b
MD5 8c5439cf418ce69e4d747c2115df2c15
SHA1 77a9d3884ab2c72ecf4626163fe607ac93cfed6c
SHA512 63b887c2873d276dbbdab85ee64a15d1a3168a945cad54bcba633a7af2af68e85839f4fbab31942653c787285f795c4e5c36b7d4c8c8d4844e3231820bd74e9d
SSDEEP 3072:j+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:j+hFD+7t56OD9ZfSApprr
TLSH
T1B9D30232AA95D8BBC9BD6541F157A300CD72A8ED41DE3A0984465F8EE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download