18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89ad45b4a0e2d547c1e09d0a1ea94df6.exe
Size

240KB
MD5

89ad45b4a0e2d547c1e09d0a1ea94df6
SHA1

ca32c2e492bb6d0753aab59993380db79b080740
SHA256

18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8
SHA512

22c575d47780046d845e0c383bf02aded47d2813173ea6f07180f8726be42084336ef5009c34c5c8295d0deddb3f19f6e5fee1902d62ac9499a117e7de59c4ff
SSDEEP

3072:skv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42pUvp85lmv6RReHeP3Kqc:/MeNRFLIu5ckeHgFGD+jpUvwzzeot+

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
576	chrome.exe
924	chrome.exe
2920	chrome.exe
2068	chrome.exe
3048	chrome.exe
2412	chrome.exe
2080	chrome.exe
2660	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2920	chrome.exe
2920	chrome.exe
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2080	chrome.exe
2080	chrome.exe
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe
Token: SeShutdownPrivilege	2080	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2920	chrome.exe
2080	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2920	2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2032 wrote to memory of 2920	2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2032 wrote to memory of 2920	2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2032 wrote to memory of 2920	2032	89ad45b4a0e2d547c1e09d0a1ea94df6.exe	32
PID 2920 wrote to memory of 2936	2920	chrome.exe	33
PID 2920 wrote to memory of 2936	2920	chrome.exe	33
PID 2920 wrote to memory of 2936	2920	chrome.exe	33
PID 2920 wrote to memory of 2704	2920	chrome.exe	34
PID 2920 wrote to memory of 2704	2920	chrome.exe	34
PID 2920 wrote to memory of 2704	2920	chrome.exe	34
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 2696	2920	chrome.exe	36
PID 2920 wrote to memory of 1700	2920	chrome.exe	37
PID 2920 wrote to memory of 1700	2920	chrome.exe	37
PID 2920 wrote to memory of 1700	2920	chrome.exe	37
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38
PID 2920 wrote to memory of 2684	2920	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\89ad45b4a0e2d547c1e09d0a1ea94df6.exe
"C:\Users\Admin\AppData\Local\Temp\89ad45b4a0e2d547c1e09d0a1ea94df6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6db9758,0x7fef6db9768,0x7fef6db9778
    3⤵
    PID:2936
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:2
    3⤵
    PID:2696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:8
    3⤵
    PID:1700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:8
    3⤵
    PID:2684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2520 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2544 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1152 --field-trial-handle=1380,i,246864733246839051,6109321286813057414,131072 /prefetch:2
    3⤵
    PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6db9758,0x7fef6db9768,0x7fef6db9778
    3⤵
    PID:1616
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:2
    3⤵
    PID:2532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:8
    3⤵
    PID:2148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1504 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:8
    3⤵
    PID:2696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2084 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2520 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2528 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2256 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:2
    3⤵
    PID:308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=2056,i,17699941479610997270,3851744564196759646,131072 /prefetch:8
    3⤵
    PID:1628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2968

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ade370d72a5e4a9155639bd6aa7522f6

SHA1
1f3fd4c8c7c358053efb7a665155bfced357badf

SHA256
3fa4c0d6a158c0cf88ab17ad09018739515eefc3ff31bffff3414cd50c4a73cb

SHA512
5723284b5ac7e7c953f0582598d34b302ce620bcd0f9a4261bc364ce033669eaaee298c47f4a17940710f3e656c7e160c0dc0638b839317e7221427332ef076d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
ac3724ed22e059f8e96f3741d51695f2

SHA1
298369ae8bebe2d68078d879191b2f5be460da3d

SHA256
2b0e3c0848edcb92c655256acc4333addb6c4f9bad84f03c1b6489eeae244ccc

SHA512
1cedd179251923fa6164fdb46402955fc8c8fb46432e54a6a8c842fe658f61ac3ed779b32774dd095852af1dc61738f4861a1d235e4591a973cb4e6de7a8934f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
7bd07186bc64f826ccc65d82f86cb52a

SHA1
9ea516ef8c531194624b93cbd87518d299a50466

SHA256
4f79f910cf5cc90998e7f6002d8dd400fc64e0d43a2916360f2311aefdc09e1d

SHA512
7efcb56b064113197a68ba436ac897c10da1ff4566954b1b93374c219130da1bf2189a5242ce6c5f3635098cd0f2e8b70f49cc0b4eee9950b1476a649aaee332

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
5641bd456e6de270948ab7b30a3e8bbe

SHA1
af8405f79e810f28ad96a5a3b9ea9b9b026b6316

SHA256
910138f82ccfda31f8017db309bf31c29fa2f1b83be84f9bb9bd5112ab80d635

SHA512
05f5ca5f19d453a9878a1eae96cce22ee651fa5a03ddc4feed463f9d958868aa95e48ba79cc2a2a162f3a4415d311a0a17844002bf7d173eb704755ba0134d55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
0ddf57089fba9cfe2f096b9ffe65b676

SHA1
aba22daee3bf1bd7c3d896e3121a037568aedcdb

SHA256
a702210d992c968809fd2df906157a154203d4cdfb22e598f7087418ca7b1229

SHA512
4c4e537b55f7f6abe2f7f4efeaae97475d354a076b639b101441bafe22cd544e767037b845108b5fff718eec079db5d7ec56fcf1160f5c1f25a4547908db3e8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

Filesize
92KB

MD5
0bd1f6daaebb93aa5a82803558b086a4

SHA1
265117a2c875a5ee6408cc1e0a33211d0994d527

SHA256
cc6827b26f65996a60986984f9cb1dc0c4e48207ffa5d0b2f85b8b9d1656b738

SHA512
6f5446c7524ac111b8ef0b9900b26bfc6644dca99a5b111788b713f41f96c8881ff0eae36dfa2e1b6bda7faa33e8b421ced1da25fcaa8279b632505148de9221

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
cc9199a5bca7e1edd691351fd33e17b0

SHA1
7c290b1fa34e62ee9ca2445f4d1ff6a3c36b6df9

SHA256
43e74098b0c7c8de75fc4388af116d764a0739b5bec22c3897ec704971fdfcd4

SHA512
9b96e982ec67d9d8ea4f50a3a323f7fbfe49bdcc6137d744c0016e779ac2403ad7bc398dce44f977d250922f7d4bb2ed9e719b6d5857924b403d7b20ab321aa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7bbd2403af57a6e44edb1999af69456b

SHA1
9af77921b11d522682b7edfb472641363e9cbf76

SHA256
fd8eb1aec7b917260f8e445c3b8e4540b25f6ef9ef56745eb44385dae065e92f

SHA512
349b07b17ea83a065e24495bbfd6629df718cf99704531c531d90e18b718d1a670e8df6f5e2456263524444da5860bcb3f3bba1af2fea4a6e1d0ad98b3e16a35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
d128c32742969d0a60cf45e520c8ea4a

SHA1
2373e1c39b68bddef64586d1f84a8d23a6ce7c0f

SHA256
3c6b85af8355c6d06cacbcc7460a2bb26b27f630cf68b55374d42d6f0415b6fc

SHA512
5cefe8031d8ac6a2238c4173e2d88ef047dccf8b359d941db99abab8508e6ed5bd2767114a1197bbf0b42377322e74467652f437b720eded2152e0271ce27748

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
c7f879fd121e6f7f65e5576ace19a5b1

SHA1
6db1286d7af0a9eeb2a8d6efa8c3b982aa402421

SHA256
166e71fb70b78dbb5562b82c88b0c075657d0f6aa5e8062417d8e400d516fbe6

SHA512
507cbb9d4888acfd93e275834bfb545e72b919a9abee4f454ea618d045bd2160e70d289d8c5da365e760cebb483703d4622e2bd280f3d5d51f51939cb7b61fe4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data For Account

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
ab357d5dd036d555e7aff1aa0e134fae

SHA1
7d40f37824058914a6d3ef387a6d8f1a3c9389eb

SHA256
ff2a4bd6bb1d434ed7083bfb2a6a4de47af88297a2831adeed3cfb099b15fb5d

SHA512
3f980850d6ea55ea0180ee9d7f60ef8d4de4160d21c45992a451515995c10eb686916153dfaf7e9749c064816cb58195768b592044ea3c8a5957993e2ed9331c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf76d884.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
b140a9b85e51c72233b2fa1c0c43d12e

SHA1
8da8046d30a4d84247661bc5483903305594937d

SHA256
8585e5ca78a5b6c2e5f39e88ff3a779f856a4a2c6a2d9b6bd30a142927ce35e1

SHA512
bf7d30312a569db39d97e59a73b0383b8324f0444f8fb0655f94fb1ce980d8862566a79d629c296057b6f755ed34b7083458c72201cf7cbc05e4534b56c92904

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
4e21b5a43859918386bbbd35774aa8db

SHA1
7bc93b5810b688b9a79bf9c68512ae859b8a0ff7

SHA256
2cedd9a80b881672e6887e7a2073e13d87bdf9b48003b5518829f2c112d54446

SHA512
a3ac452ddada93568616b07ea8fbbbf78867c5459758c3cdaf93e342a1e197c4a1bce8e846d3b412f4a71a52c87d32e7076310688919ef46fa60e10a051c1547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\LOG

Filesize
191B

MD5
23946f4d5a8c1f1c2380a058bd96d763

SHA1
03651529409c1ee06b30fcac721bc675de3f919b

SHA256
b7cebe1df98fa5e9460d4e3a67590c3a69ef74f039e1346f6c8c7f7bc10b7432

SHA512
a79a2720adef68a464128c0c81e8638805cb2855f287706f49924036d2d97e36170542038d7673f69664a127f634b70c989ce3c80161c34af8a22d4514c5adfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000003.log

Filesize
126B

MD5
75fd43d5022bdd2d2627d6944561b2f6

SHA1
a23b313546c837e097f8900b207b9aebcf67acee

SHA256
3363fa9a21dc4db7dc25aa12fa1e9f4c42cf3d07a21814dc37e2a587462564a4

SHA512
624e947801c3c24ea5eac7b6c193dbffe2774b0c090ab37c9862ec9a8e366aca0c00dcf5ef63c77de40eb5d2af248a24e0f70a8395ba9671c33023a88fcc8a29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

Filesize
200B

MD5
2e6d2f06c1ee27f6ed4775c11926e0f9

SHA1
bc47358968c36b601ae6ee6a98a9078d8ecaf120

SHA256
8ae432720396b939e26ce5c563c2d0f033697e757b1ddb3d82ce9e67544b321b

SHA512
5bc83ea2dc881374c3239c95a2b3937d082cdaf4976d1641e6677e3ed64f09b119225ac2b2c32d3807cf04de2a0c84e545f89ec5186cce8f776ba6266e5a1a2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/2032-0-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download