2e520faa2b71ba56643153b77c2908c0d6da34a2f6f9abaa7cbadab9278dc99e

Analysis

max time kernel
36s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FortiClientVPNOnlineInstaller.exe
Size

2.7MB
MD5

11bfc265fc53ac4756e4ef2759ca10eb
SHA1

e3d2bf11618c39dfd036bb33ea96aa5f989fed25
SHA256

2e520faa2b71ba56643153b77c2908c0d6da34a2f6f9abaa7cbadab9278dc99e
SHA512

6b1e802f82002c5f8162a48440e09631da12fbfa283fc03bbf405938406955581764cda3ae57021d9e1b821a128b227e77b38dd6994a655f438ac5081f5ae689
SSDEEP

49152:nZ2d2wu+8ewJobcRgEekPZ99ztx5IX0hL5m6bgy:nZ2dnu+AMW9x2O

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

FortiClientVPNOnlineInstaller.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FortiClientVPNOnlineInstaller.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FortiClientVPNOnlineInstaller.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 7 IoCs

Processes:

FortiClientVPNOnlineInstaller.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8052F904-874D-4d28-9380-AA9BDBF13AFD}\InProcServer32\AppID = "{65A05243-1B82-4C67-A610-2C5A9DB7B9FB}"	FortiClientVPNOnlineInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8052F904-874D-4d28-9380-AA9BDBF13AFD}\InProcServer32	FortiClientVPNOnlineInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	FortiClientVPNOnlineInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	FortiClientVPNOnlineInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8052F904-874D-4d28-9380-AA9BDBF13AFD}	FortiClientVPNOnlineInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8052F904-874D-4d28-9380-AA9BDBF13AFD}\InProcServer32\ = "diskcopy.dll"	FortiClientVPNOnlineInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8052F904-874D-4d28-9380-AA9BDBF13AFD}\InProcServer32\ThreadingModel = "diskcopy.dll"	FortiClientVPNOnlineInstaller.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

FortiClientVPNOnlineInstaller.exechrome.exe

pid process

2236 FortiClientVPNOnlineInstaller.exe
2560 chrome.exe
2560 chrome.exe

pid	process
2236	FortiClientVPNOnlineInstaller.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exeFortiClientVPNOnlineInstaller.exe

pid	process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2236	FortiClientVPNOnlineInstaller.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2560 wrote to memory of 2568	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2568	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2568	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2968	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2804	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2804	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2804	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe
PID 2560 wrote to memory of 2888	2560	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\FortiClientVPNOnlineInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\FortiClientVPNOnlineInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6619758,0x7fef6619768,0x7fef6619778
2⤵
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:2
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:8
2⤵
PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:8
2⤵
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2200 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:2296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1368 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:2
2⤵
PID:1888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2908 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:8
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3680 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3792 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3956 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:1584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2256 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2288 --field-trial-handle=1244,i,17761377188863898486,18428507233083392737,131072 /prefetch:1
2⤵
PID:2036

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
16c79bb4d24300a7f8453f97ca192f08

SHA1
cb16f4903552e0a30be321412db57a7e6571d2e8

SHA256
3d7d676d296303c4350e48643a5e3fd5a5fa52debb7a00572b7a8aa390b2580b

SHA512
b8be69bff5f72146a9939cc309882eb7ef3fdaa00a84feb82498403908de37f1589497467db82bbfd6291dc66311ca1554c51e020d9821ecb2c1d0bffd373558

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
554dc5e0c8d68ab5cd124753cca0e50c

SHA1
33d95812552097c9ce77ef4f098a1ac0c2542554

SHA256
01bcdd11773ae5947855edd21021264ad1bf1304d724e8138789966a2bb9001a

SHA512
17a2a46c59066d2f13c65c07b6f48067d5ed047e5c03d1a3089759d9a4803c6e2e6a6c9c5b0812874c51fb620b6e74fe3ad1f2e30f8890b1c0133accdf9458ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e045c2b99b7c43998c28957dd558fe0d

SHA1
5ada9f2cfac4818c950b9093ac047335d8074d13

SHA256
3bcf288a91c4196378634f952d16ab1eb462606c69b6660315beb2ceb175d435

SHA512
08a4eeeeef731a9a29ef0b2a7ecf4735b14bbbec364b0469fa33b76dfeff049be50013f8a12efe3d5f28036a8c4ab70ff3f6a0f27ba0a72298583750db509300

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a5ccba007a4cf4dacc9181f48dc2157c

SHA1
70874b0107ab1de2b29dbcc1f21c1b1565dc5e33

SHA256
658a017f32ba7d8d1fe4206db5d9947b1f261ee295bb86f0e41b43321678ec03

SHA512
b5f1b5cde72bb34c9bbd50e502b4c7bb21419e2419801987581b79b81c7aeeddf3636c9401a6013a925ef752b92dc885edf73bf25eba7723e2b9de54ed400572

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
6a1069b6dd8b8597287786df2f9a5a13

SHA1
490d017e4c47d7c2224416b2480e6243937161bb

SHA256
9ddeddf601b68e29bc0e4fb0a8f304e70fc20bcfe9cc9f6a591b759eb2a7a7a6

SHA512
3a43c535160c085edd052e3110df8d2f35436bb20a35be52ca5738fa3dbc617cfa8bf4f35a539d30c8873e8862b6877926bf94f46248aea14d1894f5e0b76e8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
46e0b9c2fa4140ee3a9ff37c8f6b4aaf

SHA1
89a79d221eb6bb97b39d9e323ffc082aea3663f3

SHA256
ef8da79e41d036a618e0436936f75e582d3f58ea805f92127e4392e45301cbf1

SHA512
867cec306c11377af3823336e52a4f1bf429725f81d03b337a058e0c3669d190e686c3857658e59474aa685649854ef667d25e9eb853e5e9af079cb6359a0844

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6999944fa23340bcb3831992edbd0e31

SHA1
acd43e2e02204cb9069436fbba209c65f3338f3d

SHA256
1cce2d01cf5675ff7eec7405af23dbc9d3c14336e75abbf513c0107f9be34423

SHA512
d549541ba57244fdb67db8fd9175fc02fece1a4146f1f38675123267bcf27c47a281bfd3f5939a30519359884bcdfe2b3f96ded4e9912949365e1e759a404675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
baa86f8972aae0d1418ce4353f4f5c87

SHA1
455219b4667da6618b63b601dc57748de6a15491

SHA256
729f0f4efb913ec0333618b9cb2ff5d3b357b5dcb6ab568331f5ea0038cf6a59

SHA512
f2a20d32f1d49e37e46228196c8467f33bce2059776652e14d3d2aab244484b18fe5eb66ad7c5a59f162f05068729cb53eb6bee30499bc4c35f50ef8472e59ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
775de0629e5ba1b43eddc3c311252d6f

SHA1
38c471c2d440a3a984a8523dab71baa1229b9388

SHA256
93fa13bc3d07130c8b9b53eeadf914fd57bd09343541e4a9ec34788c794e677a

SHA512
c8978c6b577251e85264ca0124e7f79730407408b82700e4956f34fbeab13ef30a82e87f3768e8e179a1df42c7750cde1dfebbd2f23a434a3b6fc3bde281dfac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
320a92acc7e6d0a8be38fdf919b16150

SHA1
8a47b5dc55b1818123b8cfcdde6a4863146100d2

SHA256
334675f0a3027c303971f6f0fc94b2fc872d2b9b038046d15b046b6946d915e0

SHA512
8558d75dccdaf74cd6ed5448e0d7641467338fdd051252e399b8208b191c47596e94af96960925991b249766853d08a48c52f023d89cb16db5f6b5ea9c1ca15f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF77B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF79D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\??\pipe\crashpad_2560_NWXARVKXSDWFDPJQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2236-0-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download