0d1c4df206b462ea752563b5f92c6e3704d28e70a09ba9adeeec6e3b4d62ccc5

Analysis

user interaction
yes
max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_1263.jpg
Size 46KB
Sample261029-xe2awsd18z
SHA256 0d1c4df206b462ea752563b5f92c6e3704d28e70a09ba9adeeec6e3b4d62ccc5
MD5 b8705ec68fbdd253621931d393026f99
SHA1 44f4d0b16240a062976e72a7012931cdabcd75c8
SHA512 cab4cc92fa4c3ee65c684f10410e2c2ea9568586cace5ffb4f374ca67d315a1b2717f7d1e63c34e93f7de654429f8548ab6abc1732fb535270a13ab68bcb1763
SSDEEP 768:TYycv9FtjHryqdZO2VPd1m6gFyuG9Uud1QzcKcdFKM6Ig1PUW62zgFCMpFiwlQfK:TQv9FtHFl1m6gUrd1QQnm1PnMJMTfAIw
TLSH
T1B523F2A489DD9460EE2297B93EB76FF6939FE72CDEB04515A08EC33CC7056801F44664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2720	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4520	mspaint.exe
4520	mspaint.exe
4200	chrome.exe
4200	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4520	mspaint.exe
4520	mspaint.exe
4520	mspaint.exe
4520	mspaint.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 548	4200	chrome.exe	89
PID 4200 wrote to memory of 2920	4200	chrome.exe	90
PID 4200 wrote to memory of 2920	4200	chrome.exe	90
PID 4200 wrote to memory of 2720	4200	chrome.exe	91
PID 4200 wrote to memory of 2844	4200	chrome.exe	92
PID 4200 wrote to memory of 2844	4200	chrome.exe	92
PID 4200 wrote to memory of 1748	4200	chrome.exe	94
PID 4200 wrote to memory of 1748	4200	chrome.exe	94
PID 4200 wrote to memory of 5396	4200	chrome.exe	95
PID 4200 wrote to memory of 5396	4200	chrome.exe	95
PID 4200 wrote to memory of 5612	4200	chrome.exe	96
PID 4200 wrote to memory of 5612	4200	chrome.exe	96
PID 4200 wrote to memory of 5620	4200	chrome.exe	97
PID 4200 wrote to memory of 5620	4200	chrome.exe	97
PID 4200 wrote to memory of 1664	4200	chrome.exe	101
PID 4200 wrote to memory of 204	4200	chrome.exe	105
PID 4200 wrote to memory of 204	4200	chrome.exe	105
PID 4200 wrote to memory of 2408	4200	chrome.exe	107
PID 4200 wrote to memory of 2408	4200	chrome.exe	107
PID 4200 wrote to memory of 2532	4200	chrome.exe	108
PID 4200 wrote to memory of 2532	4200	chrome.exe	108
PID 4200 wrote to memory of 4220	4200	chrome.exe	109
PID 4200 wrote to memory of 4220	4200	chrome.exe	109
PID 4200 wrote to memory of 5032	4200	chrome.exe	110
PID 4200 wrote to memory of 5032	4200	chrome.exe	110
PID 4200 wrote to memory of 432	4200	chrome.exe	116
PID 4200 wrote to memory of 3048	4200	chrome.exe	117
PID 4200 wrote to memory of 1268	4200	chrome.exe	118

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\IMG_1263.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc69e2c728,0x7ffc69e2c734,0x7ffc69e2c740
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,2732749088246222461,213329686294102002,262144 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,2758051608785359767,17220111597701859572,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1812 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,11280221373204950212,5065264326436445658,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,1936176313221766140,16979159288257359529,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,13024796488888766024,1898186217626281624,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,15885472755238625577,14793180132648996807,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,10877280469524047643,15550495562019864445,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,7917691415446315929,13767289704532792597,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5908,i,10733955431100130506,14469652234651132650,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4876,i,3628104720972134309,10246601328947996091,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,1647443672901404358,14552128016579382132,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3572,i,13629915065037582428,8115700290591684034,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4856,i,11224279113804717124,17337559721039429378,2097152 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,6127555014739580542,9368543296975001746,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,8207472816561037256,17270781185664604242,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,15844111085949282594,16889132097754949479,524288 --field-trial-handle=1888,i,17476166149946955272,8123325425376246681,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e46871a-a05c-46f9-8026-c32207a14f55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1e46871a-a05c-46f9-8026-c32207a14f55.tmp
Size 130KB
SHA256 a9fb7c6e4b439a3c2e860952d7077df0d1bbd36f290d708bd51f9c2d936681ea
MD5 200d509b094d6003a69213fda6897161
SHA1 18f640db7770e1bee48b11b4e8539eb16742b691
SHA512 829415d135e1d84a553dc70a0306c2891026785826ee580f2600246e340f199350970af0aadc5e9f1ad25c5d36d7b69d749a9b56df55e869aca2173ddc5011e5
SSDEEP 3072:U9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:U9+hFD+7t56OD9ZfSApprB
TLSH
T132D31232AA91D8BBC9BC6141B157A300DD76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4289c93a-784f-42bf-91bb-4467c0b1a260.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4289c93a-784f-42bf-91bb-4467c0b1a260.tmp
Size 270KB
SHA256 6c2b31ffd826f2e2673076aa4a84815966ac4f4861012b6bf40e25a39213ca1c
MD5 01d2c0c0b1864f05a9e26e706ecf6e49
SHA1 c254fb91cab7ab39d2dea8e6612e55d58840286e
SHA512 44f046efbfec6c7fc7af660c1e1758767fe1f63fdeda8d3c9c11fc64d48c8633eca656939e2b0ee252c44113f25e1dca393793c07799b5653b14f716f233900c
SSDEEP 6144:rxRbpRWeP3EGlT/aP+00blMF3+hFD+7t56OD9ZfSApprt:ftRTHd/u+00blMF3yFSXD9ZfS4/
TLSH
T1F8442333DE95CCBBCC7DC1A6A257F215DA7898CF4485955A48C99F8E508F80C0E73A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cf274da-5f60-4a0c-8166-f8e07e3e4d82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5cf274da-5f60-4a0c-8166-f8e07e3e4d82.tmp
Size 270KB
SHA256 27f70ef53ac771e114326d0ac7bf00f600affdbfd119c3d25cfc84356d55a90a
MD5 b9ac4cafb1191241792d8959bb8c413e
SHA1 1a51b0d37947e976e1c40677d129b620ab81041f
SHA512 f261b3b23d1984e14901f73b5d26d2897a488e5f2e209197168b7d553b77d55f66b50cca5a0c84966b3f7d6dffec2a4e02675bb2b7b9edd50fd1bb0c50903dc0
SSDEEP 6144:rlRbpRWeP3EGlT/aP+00blMF3+hFD+7t56OD9ZfSApprt:jtRTHd/u+00blMF3yFSXD9ZfS4/
TLSH
T127442333DE95CCBBCC7DC1A6A257F215DA7898CF4485995A48C89F8E508F80C0E73A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f4f1d1a-65bf-4f9d-8a63-ff4acba88c09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9f4f1d1a-65bf-4f9d-8a63-ff4acba88c09.tmp
Size 270KB
SHA256 5addae85c465e140842f395514f06b290e751219e183d7882c4343c5cae789da
MD5 8b1e5a5e3b4dc8773f26432468934878
SHA1 972e80dc756e58d33f0134f20f1f1849049cca4a
SHA512 f3c046b271824cb080f73f0139f62e6acd5c1c92bed943589d94ff98536945889f87c9c35498d705fb8c45e74e02ece58a25d0776ee2be69a330fc60fd6cab70
SSDEEP 6144:KxRbpRWeP3EGlT/aP+00blMF3+hFD+7t56OD9ZfSApprt:ytRTHd/u+00blMF3yFSXD9ZfS4/
TLSH
T15A442333DE95CCBBCC7DC1A6A257F215DA7898CF4485955A48C9AF8E508F80C0A73E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d8069b59ba1cdc110cde92cdc89d02bd5f23941139d79e9234b63999b8afe6ef
MD5 6a6334d09d728c10bd68a9cb97982ddf
SHA1 f0d659e2a7c1287d00edaeb72438749e469f1890
SHA512 056656c470f3886a74d716bf81c288160bf3ac69376a27708f4da95384a73316cb4b9d2af34dba26cad840e42650a59aecb6ae282426b99d8431e86b75a96feb
MD5 SHA1 SHA512

Submit Download

1be9c09b-4101-44d2-945d-6eb7662545e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1be9c09b-4101-44d2-945d-6eb7662545e3.tmp
Size 414B
SHA256 3161004fec330889b06e550e3a2a3e550c06b1824c094ff1ff433cf701724ea7
MD5 33b123a18dbd7b0b296f49b1b7ff98ed
SHA1 87e5db08f7d98efb4e8d9449cbeda39aa567d3a5
SHA512 404db54d547af31afe9bb1680768d55d537d2710335b76cb9b59ce3c1841dcddc1aa86eb78f962a95768b589807b9a5eb9efd4098b03c48d58b44dc546d23e9f
TLSH
T12DE02BFAD821FC3718FD9B2D50144B87F64A53573640884B3A3C9609CFB5A3A46D581C
MD5 SHA1 SHA512 TLSH

Submit Download

2e91658f-bf84-4db5-a2bc-cd8f6df134db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2e91658f-bf84-4db5-a2bc-cd8f6df134db.tmp
Size 13KB
SHA256 d9ab19f04aa54c7dccf5ee3aefa09f8a345bb38bb2ea6b14ce89d3b7fc1f436f
MD5 947933ce910036c06d58a124813233dc
SHA1 421d9b9e85b5e73afc3be18d363f7bdef4dc1ac7
SHA512 a9ffe98f84d6a02ae4e119d4733878672e49c034659561c828d0e56de0df74b55f6b5c3c46d890292804fbade1b891a9eb7b98bb41a7c0cfca9b3bd88a3909d7
SSDEEP 192:zREVdzc/BT2rRv7GwAPRp2bE96Hsb+WNnBd3if27VaJIp2NtebbavVyIsnAUgraJ:zREVdYBOBCBXDswXye7VaJg2NqaJe
TLSH
T11052A42EBD50B93B5CDBD329EA217B57D7F2102524802E80EAFC893C15E76DD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5954631d-56e3-48b1-97a3-168412b6a4af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5954631d-56e3-48b1-97a3-168412b6a4af.tmp
Size 13KB
SHA256 59952ce1d338a14eb3644e85a0fa0bb01666e7edb4f4f1220a6335e52c181532
MD5 8641bf6758c5fc492bcba8496d11c637
SHA1 1d2060e34757e95e13a927b80dcd03d947f73587
SHA512 2c9eb942cb29643a476cf2f155a686ec433434e3931abe6bc3200aa4a30effa51d7056f713cb9e4475370cb5438c755fb30870907a4ed7239487d1a876747e38
SSDEEP 192:zREVdzc/BT2rtv7GwAPRp2bE96Hsb+WNnBd3MQeUp2NtebbaFVyIsnAUgtaJ:zREVdYBONCBXDswXbeU2Nqaz8
TLSH
T10D52B42EBD60B93B5CDBD329EA217757D7F6102524802E80EAFC893C15E76DD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f88a28c-364d-4d1f-b3ba-f08d8b4eb358.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f88a28c-364d-4d1f-b3ba-f08d8b4eb358.tmp
Size 13KB
SHA256 401580d97762017dadbb338e6bef02c58d92f159701a94edcf9a7b28854a1cb3
MD5 e0fa11d3109bedd2881ea17936a5c273
SHA1 df0bf7fd7aaa1b60505a7a54f4819e5cfcd568bf
SHA512 6f161bc34f0cbbdf4e3caad67c80a790807a15a04f6cd4acc2dd79c8c1015a16a9b081e19039a365a631352523a204702a440ca950e311bf837f4f3e1d51c1c3
SSDEEP 192:zREcdzc/BT2rRv7GwAPRp2bs96Hsb+WNdLBd3if27VayIp2NtebbawPyIsnAUgrK:zREcdYBOBCBX3swBye7Vayg2Nqa6e
TLSH
T10252A32EBD60B93B5CDBD329EA217B57D7F6102624802E80EAFC893C15E76DD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64cee4ca-5666-405c-8b83-0d0a570cdb58.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\64cee4ca-5666-405c-8b83-0d0a570cdb58.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

78637c58-c54b-4766-9c5f-8e9d9436a49d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\78637c58-c54b-4766-9c5f-8e9d9436a49d.tmp
Size 12KB
SHA256 b3254545080e279e51ed0573065998b4d29bcdfc89b66fb86906ca0e055d0a18
MD5 2bf8db95a7d92e967e67bff046978a28
SHA1 459aef71229654b5c9f79ff03780edb90061c4d7
SHA512 3d33b8b62b1a31eeb4c4187533929fb58341ad70e985f1373bbc0f24e44ecc801083977893c8b9ef3141248ef627117314166921d470ed3847dd2cbeb95f1703
SSDEEP 192:OREWdzc/BT2rZv7GpAPRp2bE96Hsb+WNnh1MDT2xp2NtebbaFVyIsnAUgtaJ:OREWdYBO5CUXDswbE2D2Nqaz8
TLSH
T1B642B42EBD20B93B5CDBD329EA217757D7F6102524802E80EAFC893C15E76DD621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 77KB
SHA256 cd5b9997fa362be16ddb41e19a029a16e7e114a67b46e9833ac0fa7b09c8d51f
MD5 3d4ac487074103ee43a5bf024eb8b068
SHA1 f7f6302e816f76b3843e351bcf7e1138ecaea1b1
SHA512 98527e717843ab3dc3cb5458dee78f63c087f52eddb12b94c376a27cc003a5c98801296726acc079113e74c8e5044f32f2f7358479503104686dabb17a90f25f
SSDEEP 1536:cuIOAq5It8HIZTg/jyJU30LEvnBSRj9gmasW5fQUrhCfTuqRJm:G7t8WTg/O+kLin4VuJUk
TLSH
T1FE730260014D5DABF124EE16827981C663D96BA9BF28F6DEE217032F30F8105A7DCC6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 4291c2070109948094cc5fa3175c5cf7bd067f3a2c505b70e667762acbc7e872
MD5 737971b8064e4ea54a30fc87876eb5ae
SHA1 39c599ce24c02a75dce0d84d31ad7015399c910f
SHA512 454d796bd573977fc9c65fd32339087062b5984e93c84d7f41acb590b6b05594da20acbbcb05b50ae481fd27e5b8f4aaaeea0a247b281bdba08e4022c55d4d87
TLSH
T19CB012DC91D40519EF99413639F40C1552209934840D471340F80069D41B7D00100C12
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 f6042234ef1fdf274d93d40999dbc2c444518bca0c029ab65428c9dc2093d0a0
MD5 b7a6375d58aae58228e779b13cf11edd
SHA1 e4d31580a6df9aa7baeec6dcee0125b628c2a79c
SHA512 98967ad1555989b5a09180501bd870374f69483bf113eee04ea6eccf19b1292e162d67b64f2ff054940d382c61c9186b0a5a1cfde7315383ea5869775722e5dd
TLSH
T17AC092DCA1EA005CE79C81B868B608A795008F32AAA083A381F81A68E0026900100C13
MD5 SHA1 SHA512 TLSH

Submit Download

159733a1-cee3-41b3-b19f-90523f3fbfe3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\159733a1-cee3-41b3-b19f-90523f3fbfe3.tmp
Size 5KB
SHA256 4dcd7f14147e27e8a02c56ff5eca32e86f42644c21ad6b935307d271ba73226e
MD5 689b9e558b0a5816a362bfce15740f94
SHA1 4743525cd9551857cc9f102e8e6f18c143a9493b
SHA512 0ae31e2d9fc9c8b4a09c24d8789157531b957d15dd151867c520ab578494b3422d80b40b9a945286fdec05ab3145f01b3b26ab577555a6369e10b0fadd950b9f
SSDEEP 48:YALlqkqVhuytZJPtwjhpt/txaXYfoKsegmgUxJzsu4sqfs3os3KsPFJzslCsFHz8:D/QHZ6ztHaIBiUnqenFk7HzUbNRIF8
TLSH
T1C6B1CFB3C3E9476DC52196F09B146A1BCF6E451893583D5B88E4AF5B83F2872F28070E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2270ea7-3b9e-46e8-aae8-389a70a1b33e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c2270ea7-3b9e-46e8-aae8-389a70a1b33e.tmp
Size 523B
SHA256 145ff709000a246681b7c6dd9d0d7f90fc30d91921db4b8f184235487353064e
MD5 2d64ead4b21d37db349aee421af1a6d5
SHA1 e46b40aabf5e89f2dcb865c8116b130c7e9448d9
SHA512 23d71cd2dd20d9ba3bc3d76ab265807b4df31cf49166eedee6596eebc4c70ecdf48ef44f99005ad5792be56762d16fddef098950c252a1c0305eab7722caabef
TLSH
T152F00EE3B6ED306B81BE05BB0F04B80939B9B434124068F8CE9B83ACA0D18E30F12403
MD5 SHA1 SHA512 TLSH

Submit Download

fef8a678-4eb8-44cf-928a-fb5ea4fd9366.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fef8a678-4eb8-44cf-928a-fb5ea4fd9366.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a5324eadfd380f6596a416785a30e87ae5f5641547106c9ab6151632e1e7bc60
MD5 6c48e9998f3091432413eabe59d1b95a
SHA1 97a26b00a55c0a0fafb4acba95d4105c4a9c63ee
SHA512 026987d97f4c6ab24a45d33864feb13ce9498cd1ee2f5cc419d5cec36285b6959c940a356c16225424458dfed64a28004dd7fbe7372299b6fc8f80d33365a4a8
TLSH
T10DB01246C0C22701C08103B015D4E0543260CF34D112138645F00D218E311E09017209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b54100e7ead9cc06000a9e6feef9d2d03e5e0803abf6d589a6600cb9a674b61c
MD5 d98e9e33c93c4b55eb4abf8ca551e032
SHA1 986b518fe34e2e87b9caa2e0aa4ef0555a839169
SHA512 434604680829ab6aae06212e1f491a047901f76d60ac017e67663135d6bffbadddda09505af12944b6c641cf435bb95a014f3a588cfc7d4b0f0132b05667117d
TLSH
T1A2B02280C3823202C00303F038E080EC3020CF38CB03022B82F02A3ACC322288820820
MD5 SHA1 SHA512 TLSH

Submit Download

fe5eb9fa-e451-443e-acb3-19ca6b009786.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fe5eb9fa-e451-443e-acb3-19ca6b009786.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 46727a2e59ba5c3d3d7bd7b47c1f80115721d89a5fc607e0cadfeea56b9790e2
MD5 c987b5918649a6328996fb8741f037ff
SHA1 2d1ce5e3d02e26f42ffa7188ca8b08bebc29de81
SHA512 36c2dcd6a1b4085ae8b78835ae804c5bf5a36119293210dd3370507486104e05d3fdd82a403c8c8310606bbcc2bbc36af90c8f583f5f6c998d284a7776cd9311
SSDEEP 3:MsEllllkEthXllkl2zEklqMYa/:/M/xT02znqMYa/
TLSH
T1A344040CFFC0540DD51010304411C35053F0D43005115FC734D144335DCD5414C10440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e331030e-9912-41f1-aff2-4cba704731ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e331030e-9912-41f1-aff2-4cba704731ba.tmp
Size 270KB
SHA256 ce2eea4c1a037bcf57972af3deee8979cc61dc218febcb988e2311ae9675d60e
MD5 5ac3617fbf1436cc5c1d0f0c7cfe6641
SHA1 e91af6c5e9a62f43c163dfede04b85c382da765c
SHA512 123321d4541317d6849195214c5640bf7439df8972cffd943a93cc871cc14c2cc7df3aeec4d2e107720fa0c612eec05c4f006793aabbca4e6202aa5a940f63ed
SSDEEP 6144:K+RbpRWeP3EGlT/aP+00blMF3+hFD+7t56OD9ZfSApprt:/tRTHd/u+00blMF3yFSXD9ZfS4/
TLSH
T1C3442333DE95CCBBCC7DC1A6A257F215DA7898CF4485555A48C9AF8E508F80C0A73E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download