2817c7f5100108bdca6946d1027566de7a128c0e52fee90db9fe67ca2f64981e

Analysis

max time kernel
1799s
max time network
1803s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

functionalities2.png
Size

73KB
MD5

d27f7cff4db6458edd548d20c41565a1
SHA1

fda531d527be5f908e82eee0a54b6a03521c5f9d
SHA256

2817c7f5100108bdca6946d1027566de7a128c0e52fee90db9fe67ca2f64981e
SHA512

7cb1984230729445d10ece5fc0dd5dd2f92993de1315261080783ddca0b6d28beaf8d7a4f3406566c4287f5cced7b379aaca23bba755546adafbf6117c926b0b
SSDEEP

1536:qNpoQE2ygvB2zUTqvq3PLxloMfFxtkCeitQxrJ9tRXDo2q:woO/9aMbtkCeFPTDXq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609518728138926"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2944 chrome.exe
2944 chrome.exe
3356 chrome.exe
3356 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid process

2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe
2944 chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2944 wrote to memory of 2220	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2220	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 2160	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4688	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4688	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe
PID 2944 wrote to memory of 4492	2944	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\functionalities2.png
1⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb7002ab58,0x7ffb7002ab68,0x7ffb7002ab78
2⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:2
2⤵
PID:2160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:4688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:4492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:2984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4392 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:2252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4220 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4604 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:2632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4664 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:1900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4476 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3116 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:1884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3948 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4468 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:1
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=216 --field-trial-handle=1820,i,18214486767543732150,3677587738799556265,131072 /prefetch:8
2⤵
PID:1864

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
c2fd255ef5479482fa715eb94adbfd01

SHA1
6070b0151cea1ea6c0cf775b44247441e652603d

SHA256
53c33a05d92b15f941edc5854eef9236a0ac79f50f01aa59397e3a1ec6f23bd1

SHA512
55340688c44e9c7e763dddf1fa7b6f19cc7d43367af724d4c0d87af78099454a7f976b6d5312dffa10f8a2e178f8b973c675da4fc9afce6179bb4878e0b976eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
2c3b1c7b4433ad760d0961ce578515f4

SHA1
717ed4a4202a5ff5489ced785868aab625b08dec

SHA256
bc22231c4eb89ed3e522fb81a3b6f85528bd744f4c8bde8a67232106ff20a91e

SHA512
fb204e87ff510f3c04c7f362f8ea213b3d5b5a5602bd27e47c106747cb169726ab469b9e1c445ff6abea46b3f04538e63fa6ec4d4042d18887e59317ae069161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
c06561dede87f93e99cc8f9e075a42d3

SHA1
d0466ec66cea82cf3879bc7575171e7ac1781060

SHA256
8bfe55311b83cf23a420ef9904d68e5aeb414f51669a3403fe315c87018b5cfb

SHA512
984f62e8507c3fe799b68ab3e06537774170ce237471e270a5cac982547ef94ada53cb630751a8386abf5c79b3054454c3ee6c70f91fe0750a366ea5fc57a4c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
37d5c8c2028e6029b497d092c5152dea

SHA1
0b6833ea98d4ac1b4c819aa8d616b5f0f039118b

SHA256
aec1c256bd9b4ed2d8e40b4fa0894252b4831803470ffd4a473f7a4e30bd6bf2

SHA512
dcd935458b63f6ef6a8a30a2040ce1f055382249747fbfe5c5a5576da26889c13ae1ca9f6fd90bf1a279df213460c27bcbf4723ab8842b14b59f6dc0f8e102e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
aa1753184db75e13d0f0cad8f459da4b

SHA1
bcde4af39209ab841b931bf04c5eb9119ee721c0

SHA256
41c5a7cfa6aca674b140e6a177a64a87407fe868c40edec4ce0fc1a883783c92

SHA512
d20c0d89bb4fa07185a46b6494133af293acd9337ca801d1d23bb62e59bcb469a5255c8c432bdcdbbb8dfe90dbca14d4c9449e8f90a5b0147b50100f87737bd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
10888c6889052eb3e200abd34106c0d7

SHA1
bf384b5493efdae4c3c8d41008b4fae2ee423ba7

SHA256
7631b52bc54343975b7d19742f0b7a1eb2cf3bd62762f398c25f46f1bb459cbf

SHA512
ed842422c345392e83480bd76dd7c3fd08f74a8b8d162680fb311ef6c1edb757547f9c6723d8d0004b87d9d137677885ceadfae13820ec10f56049ae861eac7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
ed9ddee059089f98d9ac0423b35a9add

SHA1
ac337847bfb9791da9578a71fec6dc69b5115e8a

SHA256
c0891b5f799fe449592ba2ce357cf8589b07efe652e63f48cfe1fb5beb11c48b

SHA512
de16a7f651a6a80d508ae3d58172b5ec4411e81449667cf504c7c36410787642ab387cc11464453ee9cca24dbaacc4e9f683e30658d201647b230024b890fb66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
e9de354dd3a582f3ad70b1acb2d49477

SHA1
98c0faef0df84683f04945cf387324e97ed993a3

SHA256
96f3cb039514b02a9c647074b1cb88a618e72dff7898529b3cab5a931193a8fb

SHA512
5553f22449b5da107565cb51135f47040395275c311e4a283e3fcea1f24fc5be21c032e7a1c1a46a91cf971cd3e40713c25d9e19850eb32b625e2277b69dd8f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
d28ff04c2160e0a5fbd85b5b15934aef

SHA1
519d9b420a6bc2fdff8151a3bc883fabdf18fb74

SHA256
6fcf02124faaf85b1a48e80c4ed20862b50d151d48209c233e5f5d2aa1b6f068

SHA512
c2baf1f3e305be52f3a9d6a789db9eb5dd22d171c28833aa7f63be30669a80691288a107b24b933c34d12f9f1b0908898d48b56a0be9b589c925dbdd92d20907

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
e678312839ca3c74267761463827a706

SHA1
cf5d1c4559c0fb335f5bbd3326f84ca0bfcdd27d

SHA256
4862798a92da9aa9e8c1bee6f410465834abfab030433b0fb6afdd812e4ba96d

SHA512
d9fd5d5a1f3f0c716ccc6c36061fd1ed6cc903046d6334ec23fd30e1bab08fa3bfdcdbfbce76f1750843b85d7e4efa7911561860c1bb7a8e2110b8d8e74b7f8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
862000c825891ff4758eed43ff3aa89d

SHA1
94f3edbdf4dfad0ac2df4e4b41310726d7558e22

SHA256
fdd3f72f6d2f7919b835587e26c0417d3ac57dd4a329f6b74aea8c050e367798

SHA512
6176a619896c448551920e551fbf557029e9ff79dff97a27632d0a6df5d5e35e45e509b7aad6bed3c6ec2886e2c39d358ec41111f15585b5b62a45554688a507

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
7d82be273923f98eeed0fa1ee49b3258

SHA1
aa10d177338f7a2fc9db86e6613b5f1f06937f2a

SHA256
739fba6663a376ec99509a38595ab978a838fd27508d5a02adf8b3dd4a9a5ed7

SHA512
997b4234af676e296441b1f05203828f1cbd53086bd111dbd5aa6937e97c8b79f87e17b4825aa5e3fbb1d9b1645c0effddab7af8381c40a1e9d1f83446e09bba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
260KB

MD5
a8e4d7b8a9db8631e9862c81bfb279e8

SHA1
22e7c611d0edc4690266428fc2c3ed39c4f33403

SHA256
09b18ad731b3fa91b1a4b69402d5f9f659b52b7146b1cb26026024ddad6826c5

SHA512
7c8bd9387767c26f31828a624745c59744161082be16046e9b8e9adb443d0160269b3b9b9418eabafb3c5e811c852bf1f4f838953c8fb43256f1790bafc677fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
83KB

MD5
b2ea95c1e0d83f093f06f80d34b6d0e7

SHA1
c2000ada06d6eca741056d391166fc8cebab639a

SHA256
9b421a8196ddbf0a56c89d65b8502eb63b84d34e9c6644a88ed0426facb4e3af

SHA512
e0eb35c3ef025dfc8193a8c852898bda5c38826b023b516dd1ff0958891efed469ae52ee8135e870fdfe6aa64691c7cb3927def3c95421989ef8bc7bdae70009

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5b45fe.TMP
Filesize
83KB

MD5
2940179c1aff5f2b4d961512df78fa78

SHA1
60ce985e8ef47ff36e54f9edaeed91f0d0a35585

SHA256
7936b10ce19a4126380d02feb57ecd6aec90b520e768a0c21650ab6dcc84e0e9

SHA512
bfdd5b44bbb9de6bdf4d23d6972cfdec13562af32a20a89e54f102d8b243d4f3abbefd314f5afe0fbf3ec713f3a8d0d70b01d8d58b2013650fd233f36addb095

Download Submit
\??\pipe\crashpad_2944_GGUNSNTBLVSNPVOK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit