agenttesla | e3c48ba70cb42a88e5ebe7e22a5c28ddf8993f9c5106d0ab7e38450229f374c6

Resubmissions

09-12-2023 18:06

231209-wpygbabde3 10

09-12-2023 18:02

231209-wmftgsbdd3 10

09-12-2023 16:59

231209-vhdb5abbd4 10

Analysis

max time kernel
76s
max time network
106s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
09-12-2023 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugmanxz.exe
Size

737KB
MD5

a0a98d41a45aaa6af1ad3d084218e1b7
SHA1

aaf63c99c9313bd7ee46b67f5bea4f35e967e1af
SHA256

e3c48ba70cb42a88e5ebe7e22a5c28ddf8993f9c5106d0ab7e38450229f374c6
SHA512

96542a1828b66845095f98fb62fb99975a507a89bcc487139045800c5bc1a05bedc337e3699a06887969319b6f8fb51e568d13e42c12815d6d0092b71367e495
SSDEEP

12288:qqc3+GCueH5qtq485C4yKsh8v7TxLnnpxm2WZfQ0l9CLVzev:q/uG2qg4R8v7TxLpwHt/Qg

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
YAWALESS123@@kkk
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

plugmanxz.exe

description pid process target process

PID 2908 set thread context of 2540 2908 plugmanxz.exe plugmanxz.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 2908 set thread context of 2540	2908	plugmanxz.exe	plugmanxz.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

POWERPNT.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE

Modifies registry class 26 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

1712 NOTEPAD.EXE
1044 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

2992 POWERPNT.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

plugmanxz.exechrome.exe

pid process

2540 plugmanxz.exe
2540 plugmanxz.exe
1292 chrome.exe
1292 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

plugmanxz.exe

pid process

2540 plugmanxz.exe

pid	process
2992	POWERPNT.EXE

pid	process
2540	plugmanxz.exe
2540	plugmanxz.exe
1292	chrome.exe
1292	chrome.exe

pid	process
2540	plugmanxz.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

plugmanxz.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	2540	plugmanxz.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

NOTEPAD.EXEchrome.exe

pid	process
1712	NOTEPAD.EXE
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	process
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

POWERPNT.EXEplugmanxz.exechrome.exe

pid process

2992 POWERPNT.EXE
2992 POWERPNT.EXE
2540 plugmanxz.exe
768 chrome.exe

pid	process
2992	POWERPNT.EXE
2992	POWERPNT.EXE
2540	plugmanxz.exe
768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

POWERPNT.EXEplugmanxz.exechrome.exe

description	pid	process	target process
PID 2992 wrote to memory of 2724	2992	POWERPNT.EXE	splwow64.exe
PID 2992 wrote to memory of 2724	2992	POWERPNT.EXE	splwow64.exe
PID 2992 wrote to memory of 2724	2992	POWERPNT.EXE	splwow64.exe
PID 2992 wrote to memory of 2724	2992	POWERPNT.EXE	splwow64.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 2908 wrote to memory of 2540	2908	plugmanxz.exe	plugmanxz.exe
PID 1292 wrote to memory of 2256	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2256	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2256	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2752	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2960	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2960	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 2960	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 1452	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 1452	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 1452	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 1452	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 1452	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 1452	1292	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\plugmanxz.exe
"C:\Users\Admin\AppData\Local\Temp\plugmanxz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Admin\AppData\Local\Temp\plugmanxz.exe
"C:\Users\Admin\AppData\Local\Temp\plugmanxz.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2540

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\Desktop\EnableStop.odp"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2724

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\hello.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1712

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\hello.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5839758,0x7fef5839768,0x7fef5839778
2⤵
PID:2256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:2
2⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:1
2⤵
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:1
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:2
2⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2868 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:1
2⤵
PID:2188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3520 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3280 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3508 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3308 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2808 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3828 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:1
2⤵
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3680 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3624 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4148 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3576 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:1
2⤵
PID:2680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3660 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3632 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4316 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3996 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:1764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=2788 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:1
2⤵
PID:1964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3984 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4112 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4000 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3636 --field-trial-handle=1304,i,5649471969042622499,5638576341874695829,131072 /prefetch:8
2⤵
PID:420

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
d181d67aeb332d79618572f24982ead4

SHA1
3060676149086e795ccaf39e98b8155ef0d621ae

SHA256
32919792ff9d3606820370363a804c4333f5b9b2e52fc9f7c4dc1a882cb5d6da

SHA512
20c70ed7bc513cf2f2c7d34f82a88a0eeeae4202a29f214a483e00396e9e10cbf2bca336df18240d9708e8d7b72a46427d98064462e95195321762187dd685be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
58KB

MD5
5d05ba495d37acd79c70e5b557a0c16c

SHA1
e96ad98168fa375dea9c37c8a3263437224300a7

SHA256
21b00ea3a3278814e1e425f24bdeb0fdd79f9cbef6a4417648e711c90fb1660d

SHA512
90e9777de33256df5104001b3c76ba5c52dd71c883661e0cfb02426d45bfd805cff05bae308589f3d1a451f5163afe59ca6a3107ef0b9343c10b5c436cfb2cae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
40KB

MD5
929729aa7cff46b3dad2f748a57af24c

SHA1
81aa5db7dd63c79e23ccd23bf2520ab994295f2e

SHA256
3c63e6c7fa25849799d08bf54988bfb3b77b1d1eebb1e55a94b64995850cba2f

SHA512
a10eaa6f2708b683bd43295b9c3da5840c0eb6d8a6b9e1922a534270fecbc0dcdb4cdcc28768df292a06f6210885b510254bdca17e5b3c507b0337fe7dc3d743

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
74e7d3639b8cb2c7ee22396a7d504281

SHA1
216948133685f95b4ad17583dbbcb694ec446c17

SHA256
f4ff52d5b924bbb991329770ada177212c80704ecbb404e5ceca5abdc3798d4f

SHA512
9bdf926cf0d76281a4d360a7990851d70916a7640c1fcc3650ed064820c875169c4f4029a7b51629697eb53b54b5263532cd0af9d4ac9a46d7246371d46fc9f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
6ca24753050aafcd2167590015964f32

SHA1
b847e436e99cc626f666fc569e5b5c53342b4a0d

SHA256
35e10229a28275cbb9bc18df78e3579afece0cc15f188b6eda6fe7ff5c8adfeb

SHA512
82e66ead74faf5cb6d934ea72fcd272a3043a160c741b8799162920e2841dfca8556d62cb5acb6d313555d6ff28a6d633308022f47ee9af1d8eb3ea49af5984b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
0735047c163bc18626f8c819b9a2ba3a

SHA1
572d50238363f78ec0bf1832ed217a2f1f1ff51b

SHA256
006a6b94e040d6ee4b574b671e7028ac14ef497afb9ba2b72a233343ef02199c

SHA512
30a8ef9ac4f5201b9bfea7d445573a2b2d720384dd03995fca395658818955c3d63b2035ff28831969018fb0d99640edc657132ed6a34bf9ff0853dffaffc458

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
973863f77abec1801ed9b9d8e2b5bed4

SHA1
0dcb49262bcfc1e1aaa033438f625ef26babf08a

SHA256
910bd30ca27a8e60978e66ea64377b8c2fa0b9ad0131f06d7539483067eea2d3

SHA512
19f9696d0f3777f06d0f14e0d59a5fb517f9085a9a56c671028f89936034eead75cece2e0903faf521530804cf988f106f2fee13fb37795a5e0d46d63977905d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
041c484d505e3c1eb284e667142fab65

SHA1
31c331e1348bf849c91b0e59f149e7d46592cb8f

SHA256
5859b6ae2619aaeecde783b2bc4b4c6e781e63978508a32528a571f1e9b28d0d

SHA512
47e1740256b9f42cb23e67f9cb2403605d91a9c471493cc87cb1300a51e9469e8b481b75c1474d8b74363b1f8c6aab4e7c512e750e8ac4daa1661af734f4a36d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
217KB

MD5
78364edb4a7aa93f96685c47aefc4275

SHA1
7d3b41596aa46a6e285abb2fe378836a22d531dc

SHA256
295cc6b9def61ceb3fcad8aff0d5aff5381a18d217719dfbaec73d35a0f1abfa

SHA512
6abc2fd42ba93bfb6451be431e4f7d0df072e51eea62e67c4d9e3f8046588920a02c1f29bc84a63884616a574ab573050e4c0fe4389c44128bebd16c06c6bdab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
217KB

MD5
b2df8254b17a80b88a96ecb7d2592e70

SHA1
c57c08cd4aec7d46e99e216164dee0f73940b38a

SHA256
b85aab5ebb52ce48efbeb078f2d071d63a1f2d60c3663a15d7b311161bfc24bc

SHA512
384d56d11ed2bc193dfcecf47ff1f7bcd89783ce4f578449f1bd732aa50a1eb9e34c72753a94543c250814c0834564801eccd32273be3dedd262bc122b267192

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
217KB

MD5
b3a64fb708920b841675746bceaad6b9

SHA1
ebd212a7529f3656c96ec3be9facc778fe736fc9

SHA256
6eb92472b81bf924a276bfa5183eac24550f6e474f1e7138ff5573559e8c2920

SHA512
6516e13dd5997eda40c8bd0a731703c452ed3d72d1f5e602ea349a1d1af9b8251c6469431f78c2530960f01690440eab1dbee803cfd9c32c58dd9ce7d113c87d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ef841479-145f-4d36-b2b8-b260c8058bec.tmp

Filesize
217KB

MD5
79f8f4529d16a2941866d5c85de074d1

SHA1
29bfc55a535bc9a8b3d56400e57972b85fcee25d

SHA256
c1cc6445090c49c3e93d39ff11d720876580e76945885d1112dfdc2dfa0101bc

SHA512
86f39199fcae79467889474b5ab2038ae56227c5601186d9f11b04e8270e9ffb2a19e6987ece6eadb5460be7d04dc75b2a05153d06a0bca6c88cdab014d2d9fb

Download Submit
C:\Users\Admin\Desktop\hello.txt

Filesize
18B

MD5
a15d655c2d68822db10994a37debfca5

SHA1
a0098942f61084047fa2a13fde51dec51ba595c1

SHA256
709dca4ae610c99388f34d14e94e2fcb75e82a81ffacdc7f67e12595f51eccef

SHA512
59148da79f1f23e812899b7452b575db81a01ac914a0c520c72df93139bee565d3014896cb9f1aa938c599586935d0384fa745e5607968ba1a58e34cf8ddb5ce

Download Submit
\??\pipe\crashpad_1292_ENZAOXHYPOYPIOXV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2540-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2540-29-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2540-28-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-31-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-33-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2540-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2540-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2908-14-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/2908-27-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-15-0x00000000050B0000-0x000000000512A000-memory.dmp

Filesize
488KB

Download
memory/2908-1-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-13-0x00000000009C0000-0x00000000009C8000-memory.dmp

Filesize
32KB

Download
memory/2908-3-0x00000000009A0000-0x00000000009BA000-memory.dmp

Filesize
104KB

Download
memory/2908-2-0x00000000012B0000-0x00000000012F0000-memory.dmp

Filesize
256KB

Download
memory/2908-0-0x0000000001380000-0x000000000143E000-memory.dmp

Filesize
760KB

Download
memory/2992-12-0x000000006D8ED000-0x000000006D8F8000-memory.dmp

Filesize
44KB

Download
memory/2992-11-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2992-6-0x000000006D8ED000-0x000000006D8F8000-memory.dmp

Filesize
44KB

Download
memory/2992-5-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2992-4-0x000000002DF21000-0x000000002DF22000-memory.dmp

Filesize
4KB

Download