hxxps://vimm[.]net/vault/2765

Analysis

user interaction
yes
max time kernel
15s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vimm.net/vault/2765
Sample261101-1e9h2syshs

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2544	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 5440	4392	chrome.exe	88
PID 4392 wrote to memory of 4328	4392	chrome.exe	90
PID 4392 wrote to memory of 4328	4392	chrome.exe	90
PID 4392 wrote to memory of 2544	4392	chrome.exe	91
PID 4392 wrote to memory of 3448	4392	chrome.exe	92
PID 4392 wrote to memory of 3448	4392	chrome.exe	92
PID 4392 wrote to memory of 4848	4392	chrome.exe	94
PID 4392 wrote to memory of 468	4392	chrome.exe	95
PID 4392 wrote to memory of 4848	4392	chrome.exe	94
PID 4392 wrote to memory of 468	4392	chrome.exe	95
PID 4392 wrote to memory of 5728	4392	chrome.exe	96
PID 4392 wrote to memory of 5728	4392	chrome.exe	96
PID 4392 wrote to memory of 5984	4392	chrome.exe	97
PID 4392 wrote to memory of 5984	4392	chrome.exe	97
PID 4392 wrote to memory of 4180	4392	chrome.exe	98
PID 4392 wrote to memory of 1824	4392	chrome.exe	99
PID 4392 wrote to memory of 5848	4392	chrome.exe	100
PID 4392 wrote to memory of 1824	4392	chrome.exe	99
PID 4392 wrote to memory of 5848	4392	chrome.exe	100
PID 4392 wrote to memory of 1468	4392	chrome.exe	104
PID 4392 wrote to memory of 1468	4392	chrome.exe	104
PID 4392 wrote to memory of 4388	4392	chrome.exe	105
PID 4392 wrote to memory of 4388	4392	chrome.exe	105
PID 4392 wrote to memory of 4348	4392	chrome.exe	106
PID 4392 wrote to memory of 4348	4392	chrome.exe	106
PID 4392 wrote to memory of 5816	4392	chrome.exe	107
PID 4392 wrote to memory of 5816	4392	chrome.exe	107
PID 4392 wrote to memory of 5468	4392	chrome.exe	108
PID 4392 wrote to memory of 5468	4392	chrome.exe	108
PID 4392 wrote to memory of 1848	4392	chrome.exe	109
PID 4392 wrote to memory of 1848	4392	chrome.exe	109
PID 4392 wrote to memory of 2796	4392	chrome.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vimm.net/vault/2765
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb373fc728,0x7ffb373fc734,0x7ffb373fc740
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,2287443827946608124,340230852160651390,262144 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1296,i,13809897846589362262,6387635292038645280,524288 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,15326044368304137855,12567331816905442610,524288 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,17891278692021687442,6039071465877719844,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,1854220342792588769,15010808078828911388,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,17350524819360850252,7020428637131788496,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3896,i,17687330610001286910,8624474624631696257,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,12923856761649849715,6425533236406835559,524288 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,16816986966549183717,7836386163983566898,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5888,i,5047192439518050117,6505897324862731579,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6168,i,3994746875156600332,8961179870749489827,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6372,i,13134260645928242800,9535508056423170047,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5948,i,1394802295353901021,14957082264465937311,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,2329161864298203723,16511618717392268040,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,6398319546740164605,15908137967940166648,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5916,i,4875182041010664047,7149686998410359623,2097152 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,14768439636041203650,46973423636241670,524288 --field-trial-handle=1912,i,11549746806484096587,17829340105706105881,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:2796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b3606e4-958d-4899-a582-62f1a8b2b69b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1b3606e4-958d-4899-a582-62f1a8b2b69b.tmp
Size 5KB
SHA256 de2e4b840fbc265be33b7aca7b0cc9ad41f06ff945c742a691f4da00f51ba623
MD5 db9473d4a4d4a87113c09e8c7c1d4a37
SHA1 f6b2b27049d192c81299b6b15ece7a4e1068dc66
SHA512 fc3055f3f229cb9af906cf31cd2970d1dc5051a2c3bde3fc6d822da81e7e3767a2da3d759777d167e419cd68b112ceb32a7c820b6a6a00b5951101f2be795a58
SSDEEP 96:mC0d+TWqN/K890wxi+9M7fX3urjUEd+Sl8h4otop5JpVD8B6xGyvteer5AuD9GWT:mC0oWqNVVxi+9oP5iU2zdQZtMD9GWtwC
TLSH
T13AC13C31B86D587759E3D455F4033D53CFB860AB5622AFA4DEEA0F2C02E31AD1382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08847ac5-d953-4840-b0d8-0c9206a2a90b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\08847ac5-d953-4840-b0d8-0c9206a2a90b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1afee066-df19-464f-87ca-933423357f65.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1afee066-df19-464f-87ca-933423357f65.tmp
Size 11KB
SHA256 e640767c06da2c815ed286ec6f877da999c8d45ee5224bef9ba78426e732167b
MD5 8259c5b2279d8368ca30a5f9915c8f95
SHA1 8c0c1348940d448c1944156bf930a6e3d02ea9ea
SHA512 a53e45989b0222646e952fdb32e274feae5fff333ff4fec3a82e1eaa8517934bbce367855f1d7babb8d254717fcff2458888919e572c3ee158d7fe3c4f093723
SSDEEP 192:gRsxA3Sxv7cvAPRp22bXsb+WNnUpks72DbwU/ciyIsnAUge:gRsxYShA6XNXw6T2/ze
TLSH
T1C732932DAE11B53B9CDBD229FE227B57D7F5102224952E84E6FD883C25E79CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b8d648a-e7b9-4b6c-b6f5-ce95c0773c11.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b8d648a-e7b9-4b6c-b6f5-ce95c0773c11.tmp
Size 11KB
SHA256 b7baf1e9ad7a4f8195277dde6ffbfa071bee0e738d485680a72bfa26cc4097e2
MD5 385f12aef358f084594148c31e29fa5a
SHA1 d0f6279f9c3745d2cf461b02f9d543ec2b8f646f
SHA512 230b1c06d6ba83805da57873818060d30f47b118d2e12ca43aff1929154389a8650a4211edadf8d9882ab75004b4d2739ec0b94e60e59bb70b561220ec8b7d67
SSDEEP 192:gRsxAdSpv7cvAPRp22bXsb+WNnUpks72DbwU/ciyIsnAUge:gRsxUSpA6XNXw6T2/ze
TLSH
T1BE32932DAE11B53B9CDBD229FE227A57D7F5102220952E84E6FD883C25E79CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 92a1f5a8689e36b733ae38c6c66749c7fe6d0be33b22e2ea2e6131e03ea7aa93
MD5 dc58b5b16479b4f49c38d8c5d865e53d
SHA1 2ec087713416fa1ee7f7fa81d30b31618e60170e
SHA512 22f4819a2405db01c5f218fc4a814e2cf8442eab54ca87bf89028d2d7507ff43ebe60fa058ea60e086dd8c8a65d75b1516e0e0a3cac20b13a5a0242a0cc2efd6
TLSH
T15CD0A9E8CE21064AE700007159E1C18A3078082341030FE2E3F2F0F668B1FF80A429A2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

583da56b-8b6f-431b-97e9-6b0857a26329.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\583da56b-8b6f-431b-97e9-6b0857a26329.tmp
Size 1KB
SHA256 1418c776bf85e4120f8d6bb89a216f8705b452425bba6eea0b047ccfa099ca54
MD5 3354f4f7d58eb903b18d2360c7ca4f5c
SHA1 5c738e437c71de1342308ba3f34be518731b850b
SHA512 a8ed387e5b7136afce188bf20eebe797aade5cc35985b316f71b071aaa4027cd42da2671d6f034008f90c1d8ad5c81f7103010720dabc7e7a24a6a83ce5efad4
TLSH
T1F4219DF7C3D88A7E890092F8AB156E1BCE2D0924522C3C53C8D4AE5F53E28F2D20014E
MD5 SHA1 SHA512 TLSH

Submit Download

6e56b169-aa90-4dbb-b84d-a7792f19c59c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6e56b169-aa90-4dbb-b84d-a7792f19c59c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

cf8eff11-e51b-4173-a566-5e324f3ba51b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cf8eff11-e51b-4173-a566-5e324f3ba51b.tmp
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6a56a11-6964-4cd7-8237-daab1cac86a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b6a56a11-6964-4cd7-8237-daab1cac86a5.tmp
Size 4KB
SHA256 c0c4ec7dd3308b9a3439f58db371c82f3112c19f9d76e7097f3794c85b1c60fd
MD5 a18b638d87930ca3018d918ac2db10e2
SHA1 0a3a0973398a0f684441380ed3eceedd5e2497be
SHA512 fde9832933e057ff82a0044d3542145b309f6341c68b48efa22e9ceeadd6e3342ac1b06269abe290cf18f1f48ec0a1df143918d50f58f4a15b55299169aba7ac
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Jp0cD8B6vGyvtBWG0csE3bOv4a:CC0oWqNVVxi+9oP8DUDz0KQDeW9cH3bQ
TLSH
T1C6A13B31A87A997789F2D485B1462E53CF7830AB6522EFC4E8EE1D1C20B30AC0342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e527693-2fc2-4f9e-b46d-e78f829f70a7.tmp

Path C:\Users\Admin\Downloads\0e527693-2fc2-4f9e-b46d-e78f829f70a7.tmp
Size 8KB
SHA256 c8c72ca9cdbcbe78a6d4cd5d1467bd245100d56c3aaddaf3664b07c857ce3c1b
MD5 e47aca6cbff18e4c0810371288c9fc6b
SHA1 e7ef3785a2d7c12924d4c556059ee12e894750e9
SHA512 35bbd80383f92d3cff0014ec04e95873c66f9574dc4a1ddc8609a50fd8e47eb0545c8ded972abcd7a3c17866c1d29fee8dbeaca2233fa3f96088229f29b4326b
SSDEEP 192:jAZ/tRydl46JndtEgYRbdrtJGXmg6f3Ju57WX:jAZVRyX5JfYld5vjf3Ju57WX
TLSH
T1B8F1B054E83CA39B2FED69D8E47749FB4401DDAAC2661E0853CCF7C2268DC5209D814E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Super Smash Bros. (USA).zip.crdownload

Path C:\Users\Admin\Downloads\Super Smash Bros. (USA).zip.crdownload
Size 11.8MB
SHA256 83dba48de5dfbfd1e996555f30d29f31d432707768ea328c9c137fe8bdd5ed49
MD5 d0edbc346316dba73d9c0d9cdc77c009
SHA1 e18975578281da8c660553d5473573ed66235355
SHA512 edbce1000de476584a17c0654ef5b1d88d07e688b3ed5c2b49e19dfd89ca6c1e66b12ec48e8a783577d1bdaf94fbff98d73de4a97bcdcf3468004e433ce9fea1
SSDEEP 196608:km/QQRuuoUbC3H/Lc5zQm5XfMT9Lg8eTEXKq4hxN1q8GH3b3svFMsiHowh:kyRuuo7HARNCTlXKNxN1hIsMsiH9
TLSH
T100C633D9070EE7A1648424A78F8AEBDDF4F12435F6C98491FAC24F471BA37C9C2B6560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download