18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

89ad45b4a0e2d547c1e09d0a1ea94df6.exe
Size

240KB
MD5

89ad45b4a0e2d547c1e09d0a1ea94df6
SHA1

ca32c2e492bb6d0753aab59993380db79b080740
SHA256

18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8
SHA512

22c575d47780046d845e0c383bf02aded47d2813173ea6f07180f8726be42084336ef5009c34c5c8295d0deddb3f19f6e5fee1902d62ac9499a117e7de59c4ff
SSDEEP

3072:skv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42pUvp85lmv6RReHeP3Kqc:/MeNRFLIu5ckeHgFGD+jpUvwzzeot+

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2512	chrome.exe
2572	chrome.exe
2228	chrome.exe
2756	chrome.exe
2832	chrome.exe
1592	chrome.exe
1232	chrome.exe
2976	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2832	chrome.exe
2832	chrome.exe
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2512	chrome.exe
2512	chrome.exe
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2832	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe
Token: SeShutdownPrivilege	2512	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2832	chrome.exe
2512	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2832	2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2992 wrote to memory of 2832	2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2992 wrote to memory of 2832	2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2992 wrote to memory of 2832	2992	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2832 wrote to memory of 2864	2832	chrome.exe	33
PID 2832 wrote to memory of 2864	2832	chrome.exe	33
PID 2832 wrote to memory of 2864	2832	chrome.exe	33
PID 2832 wrote to memory of 2640	2832	chrome.exe	34
PID 2832 wrote to memory of 2640	2832	chrome.exe	34
PID 2832 wrote to memory of 2640	2832	chrome.exe	34
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 2676	2832	chrome.exe	36
PID 2832 wrote to memory of 1044	2832	chrome.exe	37
PID 2832 wrote to memory of 1044	2832	chrome.exe	37
PID 2832 wrote to memory of 1044	2832	chrome.exe	37
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38
PID 2832 wrote to memory of 804	2832	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\89ad45b4a0e2d547c1e09d0a1ea94df6.exe
"C:\Users\Admin\AppData\Local\Temp\89ad45b4a0e2d547c1e09d0a1ea94df6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6629758,0x7fef6629768,0x7fef6629778
    3⤵
    PID:2864
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:2
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:8
    3⤵
    PID:1044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:8
    3⤵
    PID:804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2220 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2448 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2500 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1132 --field-trial-handle=1384,i,6605205022701588028,14350280350001838634,131072 /prefetch:2
    3⤵
    PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5b89758,0x7fef5b89768,0x7fef5b89778
    3⤵
    PID:2196
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:2
    3⤵
    PID:2440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1056 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:8
    3⤵
    PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2404 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2640 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2648 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3524 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:2
    3⤵
    PID:2612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1248,i,15441082834407879784,15901110804083988847,131072 /prefetch:8
    3⤵
    PID:2292

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2240

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
c806c4473f82ec409d0d01281513adc3

SHA1
a2a0d2dea8fb5429c8eb339d7504936db8b7ed95

SHA256
92cd61a571d3eb9dbff4319c293faf68a9a0960bd7efac19cd413df10d0b325a

SHA512
febbaad04eaa215c13f624905fa79c93f04057432895a67e93a41343fcbd02da3424713c62b068429d75a6833981c54f1dfa2df81d9d5ec891ab40fdd5bb2895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ade370d72a5e4a9155639bd6aa7522f6

SHA1
1f3fd4c8c7c358053efb7a665155bfced357badf

SHA256
3fa4c0d6a158c0cf88ab17ad09018739515eefc3ff31bffff3414cd50c4a73cb

SHA512
5723284b5ac7e7c953f0582598d34b302ce620bcd0f9a4261bc364ce033669eaaee298c47f4a17940710f3e656c7e160c0dc0638b839317e7221427332ef076d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7b9b1cae08cbcbcbbc8664d1ded43e53

SHA1
c8958bdf11ad2b962d60b737f55c2670ea994dbe

SHA256
6622b21929c56436857eca24c061594efa52944825fa8ffadda99ca960edd172

SHA512
60936fd17204f1ba5b612c0d68696359ef78c6a0198d88ed87c84646ed614917daaa1a6b7c25f03e8213dd27b9a5b2452f29bf855cf9429df1579453a7dd7084

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
bf50aa7612ab466befe3eb2fa205784c

SHA1
965f16a74b07f83a0c060b59c53609cd1e937e0b

SHA256
280a30642175d1aafa4e186daa59753f1d510829273347a85c2cade9eeae0b8d

SHA512
3903d2e934824320851266d33ef32b498808b1d972f6f1d014da415a78f449e127ab9bbe2ff12fad35cb95d73d86906e3b3da0af7f49c8ab007e7a7caf75ca0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
fd7e9753cecff7b6df1f72fffb165835

SHA1
7e5194a7813bb0dd21d069dee907d21405ea7e00

SHA256
d580a33443c5a4adb4e5618dfb6e593d160e606a998ee171f40275ad3a9b06f0

SHA512
a2bf1e7ee31a516f1b295b628e73a412c20d62ecf590494a516caa1535ccd5c09c96f392be98aba74e06a5a63eb48c26cb2647976c1db2a7575367466afd919b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
fef4ec3269a0591931ac0b9c4d2899a4

SHA1
2fc6022b6261fd2ae75ded9351ae35e41314c933

SHA256
578f0f138bef9102a68127f2926dd8b711fb4db2d72c5ddbb140068bba600cfc

SHA512
e57f5e30db20c955e30ed080352344d4bce50b5d09aed5d1d8b6125da60839b10b8aec63142db08acff332b481f6d5c5e250e99632c8f285c8e8f5a255c20e4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
db99ad86ee5eb7b90cc651812f84870b

SHA1
762250976a709828feff43e05bdb9793389f441e

SHA256
38ef680620e7146d46839e6347af6a80f1e4d21c2cff06ee9d55cc1aa3560f5b

SHA512
2c9c2f75cea8462627c7090d4b443af9a4b232688578a49f9cf502373d62c84a0f8a7b7b8214cd6d4dccb8cb16b825b49e87bbc16bb73f122b6521f0425ff183

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
4f4291d58721711221bd70668304920d

SHA1
1cc184361d20ebf2fdfa96b069639f1c237626a9

SHA256
de86cd991d898ff2de29df924875b4f8b5daff0270a7a286eefc1ca5b817d306

SHA512
f5f3eea981fa52d8b2f2c5bf4d558583ad7ed48ac678898647596ce820f7409d75ee3811572a8ef4d26cdd941d27c68fd45406b3d7da9455181066054d78d342

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

Filesize
92KB

MD5
39df9a57e81e069c6aed364dac14059b

SHA1
12885765dc6ab8a60d73444a7834e8642a061fa4

SHA256
ad419412a59373c1cfc8809857c7e0cfbc068bdfc7ae9d46e23a3fa95d686cc7

SHA512
d0ba3951f4c2307833cebe736e85b47da005d301d6e3ad3a6a8faeaaefd3159b2d4294a506076a08c73a0b969594fce8eef9da6f2ee9918e0538ffdba3bd13e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
085be2d4918e400553208525ab4d2e9f

SHA1
2a316c9e373656044213102a91208064c64cb048

SHA256
0611aac59906a48a58da8bd5b70a13255a3f4c4f726c172887c3b37a9769596a

SHA512
51f46dd07b7458d990da3ecc6ecb47ce00ab94ae5c92534ddf2b374031912050b63dd988845b95d936c13c6955c696051f48d8bf8cdbcc5c07a1c4100d8ee3c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
030c13051d0d3c14a758b940624eedd5

SHA1
7e98fa90f6da6c5c8d05dbe3b9bb390345e55523

SHA256
0dab356a7efe2f33bdfbc8c4354fcb5d82c89338125972661b43ab5a78375c5d

SHA512
76df75e6301e3c253f5fa83ef186d80cb4df3afc0ebf772aca2e21c033a8ae66cf68f3eeea1515d2cf44f6408274e3058db02cb3f42d9302fd9e830397278795

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
cc389818a95ada64ef944d18f5d68a0a

SHA1
f6e0c329d311df90523811b538a5caa4fa3790c3

SHA256
ddede6128beeb4c2ca1e7428ce1d1875631677bfc822ea75c63c1dce7a1f6558

SHA512
c05ebf8973082edabde9a5883c6c8f2449b7566d4ddfeaf65e2f63e80aefbf6e6bfbf7e7d86aecb844acb9f4295b44d26032aa19c9903e58b62e2a316ae27c4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
4ff10591c60cae445072aa5a742e31c3

SHA1
bc46d48c3cb8fd3c9eb6e8f7c9295bdb8e531a66

SHA256
da0f7d5619d0aaddcc7216db555641867bdaef817668eda43662396d76d07029

SHA512
61d373a3ec5b9d6ef811bd13de1e907de0db9b3eaa8360b392a4a9abdea7ccd2e03524e3ab3099cf0985906e660ec2047d8d7ab17e1fa2910eca03589760c056

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
8eb63f07fc34f0374bc84280b7332045

SHA1
eabd60013af230ed03fe816208db98087d550b02

SHA256
646a6803bbd723b054016f8021a81d990120c73dbade4a4929e47ffc9ddd65e7

SHA512
03f23d19df0371afdff65f01ae017a5a7e3b9ba115494f3731e043591db298ed33c0ccdc835888580f523032a626f1176b9663038034dd4fc1043a237ca0dacd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
dd797ae4d2d2fef6c35e7e8e8fff6b67

SHA1
a20563b276f5d5832adbaeebd39e8a91f5027704

SHA256
ca3cca9acd7f50644064d51aaefc9659fabd5937492b105182f78149bfdd980c

SHA512
dd7b01e14c9cacd7b83558f7c54bc7b899addcf88ab30ef28f1d30973f4c51376d0d8a5c8ef0dcc6a9bd9962e0fc9af818811abb7e22db017ef7bfdac765d90c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
dfb4bf50a3867c23bea81157fd92cad9

SHA1
3b31504f1b7a15d26bad5ca0adef652e407e0806

SHA256
fa2680d02d30be9d6ac12ec0551a0b9700b0fa4095c6b280305c1d3c89a840e4

SHA512
d88614c7d7dad48b7250bb7a170c7014191e84af20cfa4e1e409776324915660a7c0b6fe9c7acc02ca00e4ef6cb1672553f960746f98b3cad1161b4f0c866c7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Web Data

Filesize
88KB

MD5
11b6879796f062d38ba0ec2de7680830

SHA1
ecb0f97f93f8f882966a56589162e328e2c8211f

SHA256
871b3dbd6548fda17acf2dcdc284bcd6a118e6f547f0702c801710f268743a61

SHA512
ed54facfe77e0491a8102d2846b1854aee645e1848db39b11951555d013984de710c715936518cf04cb5dc0fcc7846dcddb017bba9d299c915008532782034f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Web Data-journal

Filesize
4KB

MD5
ffb2cc5402f48a9adafdb80d0a793883

SHA1
fdf64db41caeab0f80efcfae41cf183d4d573de1

SHA256
53ebfb2d424cef244fc7473d778bd97d4bf6c1c422db52669bc9abb590bfe5e9

SHA512
aa129b232950893c4aacab19b7f48852f20848a3c0c2d0340695624c121c39a41d6d65657df65e98cac183bf20d0c82384a19ccc783dcee2aa3dd194dd4c275f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

Filesize
200B

MD5
5ede1eb68535c0d6430c697be3d864ae

SHA1
787a6cf70035e953e6aa3973eb7193d3b1931b48

SHA256
eafdc399060a3e02cd8babf6b98fc6119e31b9ab701dbd0a98760232c25063ad

SHA512
ae4ce7816309e37dc25a6bd236270af41134c2c93a21ea4c664c600aa3e4b6a38f802448512e8364759d22b890bb038a9800b6f73a83892d0c478c5c128cf7f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/2992-0-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download