masslogger | 75b7cbc5cd0106b2e4e6ec0f1ba4b0766d55fd38c62b11f2d6ac31c29a4c1e6c

Analysis

max time kernel
377s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2023 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Random Virus.zip
Size

715KB
MD5

8b93814e3c62ac5eec869f7b152ebd58
SHA1

11776bc168a7e8a766e33d8c8a33cface62c2cd8
SHA256

75b7cbc5cd0106b2e4e6ec0f1ba4b0766d55fd38c62b11f2d6ac31c29a4c1e6c
SHA512

d9ddae5cdb1e9d57b835d41f2240c1e4372ba9ef6581f0d4214ea5df6df4f6bd5b66d7cd1a3b6468667ba80f2afa2170ac97c11c60c35ac6089753a8e5a6d058
SSDEEP

12288:OzhuHVh5PoShHitRYIv6QYbuSk+dPRQpbxFNzhuHVh5PoShHitRYIv6QYbuSk+d9:OzhuFPrC3lv6uKux/zhuFPrC3lv6uKua

Score

10^/10

masslogger collection persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 2 IoCs

resource	yara_rule
behavioral1/memory/3056-148-0x0000000000A00000-0x0000000000A86000-memory.dmp	family_masslogger
behavioral1/files/0x00070000000233b3-187.dat	family_masslogger

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key opened	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	sample.exe
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	sample.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
169	api.ipify.org

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133349805044242508"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{A3F9D738-261F-4B65-96B1-CFE74D29A5A4}	chrome.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4908	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3400	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	taskmgr.exe
Token: SeSystemProfilePrivilege	3400	taskmgr.exe
Token: SeCreateGlobalPrivilege	3400	taskmgr.exe
Token: SeDebugPrivilege	3056	sample.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe
3400	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3892	3056	sample.exe	117
PID 3056 wrote to memory of 3892	3056	sample.exe	117
PID 3056 wrote to memory of 3892	3056	sample.exe	117
PID 4284 wrote to memory of 4860	4284	chrome.exe	125
PID 4284 wrote to memory of 4860	4284	chrome.exe	125
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 5044	4284	chrome.exe	131
PID 4284 wrote to memory of 2860	4284	chrome.exe	127
PID 4284 wrote to memory of 2860	4284	chrome.exe	127
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128
PID 4284 wrote to memory of 4316	4284	chrome.exe	128

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sample.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Random Virus.zip"
1⤵
PID:3968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3628

C:\Users\Admin\Desktop\sample.exe
"C:\Users\Admin\Desktop\sample.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\Desktop\sample.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3892

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\sample.reg"
1⤵
- Runs .reg file with regedit
PID:4908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcb7339758,0x7ffcb7339768,0x7ffcb7339778
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2448 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4636 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4816 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4956 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5380 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4156 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5564 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5704 --field-trial-handle=1904,i,17845081915912183831,3154150689243056795,131072 /prefetch:8
  2⤵
  PID:1944

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3648

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
b2a3974db9cc6de86a9ea9972bfc04b5

SHA1
4c87ef2c0f562a8e4e6e9a4ce4e6d3047e1d3046

SHA256
9387e1fe73f6cdb836421af310a2a13868e621dfeb3bf436f7f50dea35c5cb12

SHA512
daaa835e7c2a495bc06c4473a66771868f9d0b8a1889adf97d920a73d7cff5a849df0e62e9159340804ef62ad99001beb57f03aa5aacece91e9b991a0b5f00de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
65KB

MD5
ab339751e53027869cfe7e8efdf15ed0

SHA1
d457fac71994a7c8f404a6f34275621381b990ac

SHA256
512415367f9bd9cada75132fb7c950da994526758bf95478f846cc5a6cd871d1

SHA512
14abb84662dcd549dd9d9d42cab6eed615c0d844d1743948cf500afe1b49582dcdd08de902c556765392d2419c4baab9ed79db27d5d19be916ed504554282ca6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c

Filesize
34KB

MD5
93301c5e649eb3373234be5e4a7df47c

SHA1
fb829f8b07a8cd29fc5b0bf909ad770688131fdc

SHA256
ec0fd0dfb32380f1519fd20c85a822ac0ebdd2fc5d5be57a3dde54fe0bc73426

SHA512
2d6edf750508393f0f02626cc8994500c9f16bae949ff62ea7081dd6ee8b167a40892f0ccbe24662d413e3cd8c4a16e4f000354bb77eeb1d186971585d24eb51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
36c60754d08d17995c45c4482e5ca340

SHA1
ac171e0dfd6008d39b40e38b1c3ffe5c3385fedd

SHA256
99b682da376999db9cdf1875a3c4f750daf95d1996c49006c8572fa39ef6a95f

SHA512
82b12964961e35affe4bed51a7fee920d43a57d9b3556fa58b0574b5b9a1e1c4fd2329d8d3a6bbe4dae20321dd8f4ad6bff7f2a14938546afd5a124e13223424

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
8366dfeba9e013766a00dcc487b3aaf6

SHA1
7e596cf07c5b09fa013ac1f258ddd43a2164ffa2

SHA256
068ab17bb087cc94b4d541c15073bc86c19f1bf9c5c36c2eae5afb476f27fc7d

SHA512
e72fe618d2cc8be5095eb678a4783315f9bda59888d6bd85f747d315b5737ad8d310d8885e7de627ff31a25f0e3f03a3afe19041921cc35f13d365e6e3262372

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
e90f54e7df34d3f30b88783412e6f754

SHA1
4692d5d4c033451a7386c2dcb781a7549aaf3e37

SHA256
dfe2a0b8e1948902244e9c5fa5a2a08f6b73a1f69fcc082cfd31ead2ce781840

SHA512
2be63cfaf1b0a64798f48ea9f6158affe29813d62a9c423bff825eb32d208deff9170f7739d50dc4abacbf7647eac33ec5e56f4af0d0bd97f0aa57b04f4b1384

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
aeb10667e36c03f55a54668033d5461d

SHA1
4554da42d58fc1cf81968789d35873a0e8902f35

SHA256
710d11556d21462901e2e506a40140668259303ebab70799bdcd3136f7c88570

SHA512
233b78e9f46f09d3debe9ab2844e85578137525d235309954fea74e63fcd3a7ca990d5670b2972e157e17d6ebab48e568541fc7ab95e191aa6ee2386261c9fae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9e3171698223ff114486f44830ebf295

SHA1
d957efa6b439a5d842ed4212fce7ef2f765911c8

SHA256
d5678898bec86049b674e0c1d12a2d4ca80fa40e390825cc5ff105fd738e1584

SHA512
ec12d005131f2afe215786ca940dc0e9401f80ecef1fe915bac73645b31fe6d1f1746f8ebdb78ec9248c8d3c63d2c44c7b2722992337945efc8166cea544bb7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
ca80aecc3a614018c8e4a639bbe396e5

SHA1
c0689412cb5d9f815543b46c08f0d54bac46b88b

SHA256
cd1053af6f614db91925a703c91df99edbab3523e2f5778b73ac303592e92b0e

SHA512
a4988bbf85d472b62e95ea098ae3ddded0c7ded613d9dff36d5c48c2ccf560f26c67d52819e03ca1ce10465a8bd543a678bc52cee85fa2d31f1b18c513d9717e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
d40d3fe0db367ee4e3fa3d2785c86d85

SHA1
fde715b7400bda71dc076cfae1a1e60958cd7b97

SHA256
7663749c7c4b7c4c5c51d2e96bad6211418535466ee31b6f43795eb26f310ed5

SHA512
65872f90f50d05ced87dece76e606a03b5ae2d5d847638fde6333b8b8a7dc26cfd2b82d7bae33b440d4a727d336546d6c6119dcd32bb7abb41210485c50e6a82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b77ad217a0bed6ab845b7d322c423a6f

SHA1
28a686d28c77935c155c07a4d8b8c0e40ddfc9fd

SHA256
df999bfc6fef9e2d5f2fdd7dba957310b10cc3361d591cfd5bf2db73dc731dcb

SHA512
1b42bafa52d1d61e7fccd04fbeaa37c2e151408b8105298571c638efd8be4959b18d521859ba1a5d3c06ec7efeb3e7de5ce3bf8317e96fcfa06472ee25e99af2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bd92b4742f912c72ce92e8d219a59bb1

SHA1
02630dc7524faccb8b7acfb6c34e162fe832bc62

SHA256
ae4ac2ba2570b52aadd70aef04b03ffc36b18c5cdc4c93916ac2fabcab80a369

SHA512
e0e70a8b65faf07403319f661034067a7b9aae96be007fb3f8b654b1072495a896577354f0395ee0ffdba451b7ac9b7ae0129dc7ac9fd218fdcc692c4dfcc89e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
36c27cb3af18b0f102948c42ae487fb6

SHA1
2c21a60af0d165954d57b68d1c0f9a9963202a59

SHA256
f71e22934f613963ac81db48ca29cf935000633237e0702f214d6e89d061b7f3

SHA512
61724fafdb7420477b84365e0a01487af566a169b000470f13a306b766f6e15da7781668cb5715e43a59b5a78420f4df41b57a1222d90203fbeb7b41938e7f8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7ab3a0b5bb3d9949d2266ed4078984ac

SHA1
4857bcd01d7787fa631f51ae0abcaf0493fb049e

SHA256
d811c2be7ba2a534a6ff1d50b5bc3c48ccfe0f50421468e44ff5b3b2704ef7a7

SHA512
01e0b851f0cc98d755343314fbd6d474a22e9863d4be67c3566d9031820810671f9b8c5ef011bcfe4ce8e42a84995582bd09345a9acd990df712d0277e504d7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
a4b2851e781b530cc550ccc5f90b3646

SHA1
a959a820b1f8e6340e39ecb799f4e7055c1110c6

SHA256
7380eae1d5e66b278973ba095683b1272bc0ebaadfb615700d2376f3996cf1c9

SHA512
097310a4a1732fa23864e81a392eb9589be3976e6ddf126d9db959598a73b5084ca101dcec1e95b80d12add7989bdf8e2ca1390eee64f218f587f7bd0e7084c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4284_588919034\Icons\128.png

Filesize
4KB

MD5
3c32acef7f02a6b39f1225a25f0c5b6f

SHA1
01d6dab09e215c282e4b938110088edc4ef1aed4

SHA256
3049129afe676d733813472acdb588247fbe1a52ea03f5d71780233e0693b33a

SHA512
69378979b736f6b2a023480d45450b4f4b3c9127cbd0f421cda1dd0e90e4691fbdeac92fe161c3b4e758777909f84658f47eab2cda35dde06e52c5c26423d8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
175KB

MD5
3b856c392aaa1f11cff7f44e743896ab

SHA1
e00fa49f52b61a991434bb8a435926c2c7fe4710

SHA256
1abbe0da20240d250dd42dd386215451c7ca3f2e228a20772a4c7c721d99a433

SHA512
cce57c64dc913617f70f097ef44662504078874d8323e1ab06124f9d01ffb7dce9b90b02af09603855ced79c5f6821c7ee118f68c8d585015e166b96299473a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
175KB

MD5
d87b8fe7618cf00c697c490f04abd38a

SHA1
652acb364eb0365959909ba2f0ac97a5333e6550

SHA256
c75f32cd77b252e9d22b3a8ff2adaa43fe30704cb4aa54a47bffe20ef001834c

SHA512
54373f0fcc47150e52b549ab544222ec58d5fb44d9be1fd7261cc46e21b033e2b7fbfb1c1eb911232a35eab4a828e7cb864c0df44c4132054c1080174e5c376e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
2f60eeb64260faf8a6699dde51e3a8bc

SHA1
cc3ff69e49e94d416db564906b2fd0f87c49f181

SHA256
d75482109008c6b2d335bc2857b1bd453926358314f7dca314ee2e988e2f190d

SHA512
58ed51c3d7061f4e84465e5dcb042757d6278fccbd6a69692c888b215978dc3689fe9372489d08a27d0ba0c3eaa0d14e5bd825120aa559a7b45d07b16b2a306a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5b3f96.TMP

Filesize
97KB

MD5
27fbbe2c21d1b7803cbd8f2d91018760

SHA1
206ba0ff8512f819b3f94c581f459a03d73237ee

SHA256
7b770dc32ed6185a4f41234845d61f48b53f6b3ed713903f8c6c6f52fc22142b

SHA512
7d9efceaee8f366a9c42cb94e95988b2cb54b4674265d05e82535a02309e3d6aa78bc73f2d34050076d3d03f4cfbf8134ca27d15ae2bd6f2a84e72fc078668ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jgankdfz.waz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\sample.reg

Filesize
514KB

MD5
9c73b0f2a593fb39f3c0c80bc2851fbb

SHA1
f2678fbd372b1d29870efb306da0169d3a6613c2

SHA256
2487b12f52b803f5d38b3bb9388b039bf4f58c4b5d192d50da5fa047e9db828b

SHA512
64c3b1e9e3ea08da7bbe073f98b5d78d7a705decce1773dc9468891730e7db5fc999400ae665671a83451ef3d2489a37d0903303313a7847d4d69c85a70e266a

Download Submit
memory/3056-158-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/3056-161-0x00000000728E0000-0x00000000728F2000-memory.dmp

Filesize
72KB

Download
memory/3056-147-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/3056-148-0x0000000000A00000-0x0000000000A86000-memory.dmp

Filesize
536KB

Download
memory/3056-149-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/3056-150-0x0000000005940000-0x00000000059D2000-memory.dmp

Filesize
584KB

Download
memory/3056-151-0x0000000005F90000-0x0000000006534000-memory.dmp

Filesize
5.6MB

Download
memory/3056-152-0x0000000006840000-0x00000000068A6000-memory.dmp

Filesize
408KB

Download
memory/3056-153-0x00000000728E0000-0x00000000728F2000-memory.dmp

Filesize
72KB

Download
memory/3056-154-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/3056-155-0x0000000006F20000-0x0000000006F70000-memory.dmp

Filesize
320KB

Download
memory/3056-156-0x0000000007100000-0x000000000719C000-memory.dmp

Filesize
624KB

Download
memory/3056-157-0x0000000007090000-0x000000000709A000-memory.dmp

Filesize
40KB

Download
memory/3056-160-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/3400-145-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-144-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-134-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-133-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-135-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-139-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-140-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-141-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-142-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3400-143-0x0000019F1D8A0000-0x0000019F1D8A1000-memory.dmp

Filesize
4KB

Download
memory/3448-660-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-661-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-687-0x000002B68F2C0000-0x000002B68F2C1000-memory.dmp

Filesize
4KB

Download
memory/3448-686-0x000002B68F1B0000-0x000002B68F1B1000-memory.dmp

Filesize
4KB

Download
memory/3448-685-0x000002B68F1B0000-0x000002B68F1B1000-memory.dmp

Filesize
4KB

Download
memory/3448-683-0x000002B68F1A0000-0x000002B68F1A1000-memory.dmp

Filesize
4KB

Download
memory/3448-671-0x000002B68EFA0000-0x000002B68EFA1000-memory.dmp

Filesize
4KB

Download
memory/3448-668-0x000002B68F060000-0x000002B68F061000-memory.dmp

Filesize
4KB

Download
memory/3448-665-0x000002B68F070000-0x000002B68F071000-memory.dmp

Filesize
4KB

Download
memory/3448-663-0x000002B68F060000-0x000002B68F061000-memory.dmp

Filesize
4KB

Download
memory/3448-662-0x000002B68F070000-0x000002B68F071000-memory.dmp

Filesize
4KB

Download
memory/3448-659-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-658-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-619-0x000002B686D40000-0x000002B686D50000-memory.dmp

Filesize
64KB

Download
memory/3448-635-0x000002B686E40000-0x000002B686E50000-memory.dmp

Filesize
64KB

Download
memory/3448-651-0x000002B68F420000-0x000002B68F421000-memory.dmp

Filesize
4KB

Download
memory/3448-652-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-653-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-654-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-655-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-656-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3448-657-0x000002B68F440000-0x000002B68F441000-memory.dmp

Filesize
4KB

Download
memory/3892-178-0x0000000006650000-0x000000000666E000-memory.dmp

Filesize
120KB

Download
memory/3892-182-0x00000000076B0000-0x0000000007746000-memory.dmp

Filesize
600KB

Download
memory/3892-186-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/3892-167-0x0000000005670000-0x0000000005692000-memory.dmp

Filesize
136KB

Download
memory/3892-180-0x0000000007C90000-0x000000000830A000-memory.dmp

Filesize
6.5MB

Download
memory/3892-179-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/3892-181-0x0000000006B50000-0x0000000006B6A000-memory.dmp

Filesize
104KB

Download
memory/3892-162-0x0000000002D10000-0x0000000002D46000-memory.dmp

Filesize
216KB

Download
memory/3892-163-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/3892-183-0x0000000006C30000-0x0000000006C52000-memory.dmp

Filesize
136KB

Download
memory/3892-168-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Filesize
408KB

Download
memory/3892-165-0x0000000005830000-0x0000000005E58000-memory.dmp

Filesize
6.2MB

Download
memory/3892-166-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download
memory/3892-164-0x00000000051F0000-0x0000000005200000-memory.dmp

Filesize
64KB

Download