9012f0f2c76ef18fc1518e0e74321fd2396d459fdea7b6c187e74050aa8689ae

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
可疑/样本_guge.exe
Size 116.7MB
Sample261023-nc2zzabs61
SHA256 9012f0f2c76ef18fc1518e0e74321fd2396d459fdea7b6c187e74050aa8689ae
MD5 c18deab80dd2954c43843391d2e303c4
SHA1 0008943dd8ce6e8c5ab1a6d88b54f8a0dc6f327c
SHA512 8bb19baee02d47a2da8e1c19a563d5a9a985206aab0f132007b668b2d02e5dc8dbbbe6b68d46e881687f5caf85e173720b5d8e64b79c901c2b6ad5f295f8ca96
SSDEEP 3145728:DQoisxLauv7aACjsTrHdw7l6eGUIy5DXFQRe:DQZsxLai7OsT274eZIyhXFQ
TLSH
T1534833C3377D6238EE5AD473F9BD5FCDEA48BC2A3554E99039A17582A472FE28170810
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery spyware stealer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
6116	setup.exe
1336	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2312	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe
5268	chrome.exe
5268	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
848	chrome.exe
848	chrome.exe
848	chrome.exe
848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1140	样本_guge.exe
Token: SeIncBasePriorityPrivilege	1140	样本_guge.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe
Token: SeShutdownPrivilege	848	chrome.exe
Token: SeCreatePagefilePrivilege	848	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
848	chrome.exe
848	chrome.exe
848	chrome.exe
3456	chrmstp.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 6116	1140	样本_guge.exe	85
PID 6116 wrote to memory of 1336	6116	setup.exe	86
PID 6116 wrote to memory of 848	6116	setup.exe	87
PID 848 wrote to memory of 3672	848	chrome.exe	88
PID 848 wrote to memory of 5432	848	chrome.exe	90
PID 848 wrote to memory of 5432	848	chrome.exe	90
PID 848 wrote to memory of 2312	848	chrome.exe	91
PID 848 wrote to memory of 2092	848	chrome.exe	92
PID 848 wrote to memory of 2092	848	chrome.exe	92
PID 848 wrote to memory of 1740	848	chrome.exe	94
PID 848 wrote to memory of 3844	848	chrome.exe	95
PID 848 wrote to memory of 1740	848	chrome.exe	94
PID 848 wrote to memory of 3844	848	chrome.exe	95
PID 848 wrote to memory of 6060	848	chrome.exe	96
PID 848 wrote to memory of 6060	848	chrome.exe	96
PID 848 wrote to memory of 4508	848	chrome.exe	97
PID 848 wrote to memory of 4508	848	chrome.exe	97
PID 848 wrote to memory of 5516	848	chrome.exe	101
PID 848 wrote to memory of 2468	848	chrome.exe	102
PID 2468 wrote to memory of 5892	2468	chrmstp.exe	105
PID 2468 wrote to memory of 3456	2468	chrmstp.exe	106
PID 3456 wrote to memory of 5156	3456	chrmstp.exe	107
PID 848 wrote to memory of 1684	848	chrome.exe	116
PID 848 wrote to memory of 2204	848	chrome.exe	117
PID 848 wrote to memory of 4276	848	chrome.exe	118
PID 848 wrote to memory of 5268	848	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\可疑\样本_guge.exe
"C:\Users\Admin\AppData\Local\Temp\可疑\样本_guge.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\可疑\CR_35988.tmp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\可疑\CR_35988.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\可疑\CR_35988.tmp\CHROME.PACKED.7Z"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Users\Admin\AppData\Local\Temp\可疑\CR_35988.tmp\setup.exe
    C:\Users\Admin\AppData\Local\Temp\可疑\CR_35988.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=137.0.7151.104 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6f437bb20,0x7ff6f437bb2c,0x7ff6f437bb38
    3⤵
    - Executes dropped EXE
    PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ae1dc728,0x7ff8ae1dc734,0x7ff8ae1dc740
      4⤵
      PID:3672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,3778207122902236734,14238407803281184741,262144 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      PID:5432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1596,i,6038715440702528729,4931709077716243995,524288 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2512 /prefetch:3
      4⤵
      System Time Discovery
      PID:2312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,13374671033183732645,1743606251553546129,524288 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2520 /prefetch:8
      4⤵
      PID:2092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,17900168216511573922,16919304092844983915,2097152 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,24852138559896492,13715471306064247870,2097152 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:3844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,5106456967720501833,14239528082416434591,2097152 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4432 /prefetch:2
      4⤵
      PID:6060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,7845069400124315889,10602459644921169727,2097152 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4696 /prefetch:1
      4⤵
      PID:4508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,8174814958123439926,5338436243232175858,524288 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:5516
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff7f5c455a0,0x7ff7f5c455ac,0x7ff7f5c455b8
        5⤵
        Drops file in Program Files directory
        
        PID:5892
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3456
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7f5c455a0,0x7ff7f5c455ac,0x7ff7f5c455b8
        6⤵
        Drops file in Program Files directory
        
        PID:5156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,1491635628090775051,5136523080450696511,524288 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
      4⤵
      PID:1684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,15030458054065160492,15133694346250505947,524288 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      PID:2204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,9827560186765481280,13333830001592484552,524288 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5676,i,13994716312971033379,17303973475362860447,262144 --field-trial-handle=1976,i,4651862406738738040,16050875381489012647,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=732 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 4d3ae567dd459953f8b00b004c173d51dc3ebdeef6df8775f21afbdba78a819a
MD5 5e5617037fcd17b53eb59d5c307644af
SHA1 faaa3b3cfa0db20864c1ad46fc75c49cb16550b6
SHA512 cf27fe22e9547e90e421aec2126a9d4f36238ef7a4186e7629f35a870eeb976bcf37d445b975e297dbd47d184824d26b769d0d871feb71c087989386f96ff7ea
MD5 SHA1 SHA512

Submit Download

2468_13437227822910980.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2468_13437227822910980.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3456_13437227822889617.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3456_13437227822889617.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 5aecec84a0e10790d95f2641e20f7b98b08c3c7b05a7bfb27c6f6f2a70a0bd02
MD5 f6fa000ee393d3e0cf08be7674a3da10
SHA1 a4d0f86dc62235b1b9a4a7543feb863594afee51
SHA512 a7185f6434f940bc417f99124276ca41d66ea2284ace50cf80a2d216f38f43c32eb5b10e164d6e6cb9f987576d6f228f130cbe6f6d34b5e927ef166ff1e6aaf1
SSDEEP 96:6IamgyZBOhDc0mhK3sK3JNOkumxd1Vdx3xzcc9zRhK2HgK2hnd3V0xLoqHu2u2HT:4NUO0v0KahCjbTKMZ0
TLSH
T148F1DD9A9E03847F3BC68B6B33832155AE5F1419E7D4D4723BEB6155F0CA9A4001FAB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 7aae415a531e8332bf5118db8cfbd6b21c1d20e26fd84163dcf8867fd8e11643
MD5 4eca7d8b4778c588a7ccbee89d78b6ca
SHA1 a8d9e789329cc336f230ab3d2563badfa0621288
SHA512 f6b9474e255ce617739f84c261ff8598a3c438239006588a8b16501b7631f76a7ce370b68e39d674d3c1e7f3636e9b32914a54a8276fbd297d8e60d98f018e78
SSDEEP 96:6IamgyZBOhDc0mhK3sK3JNOkumxd1Vdx3xzcc9zRhK2HgK2hnd3V0xLoqHu2u2H/:4NUO0v0KahCjbTKMZEfE2
TLSH
T1D012BB9A5E03447F3BC28F6B33832255AE5F5409D7D494723BEF6255F0CA9A8002F6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ee4bed2-4dec-44bc-87ed-d50bc9155253.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0ee4bed2-4dec-44bc-87ed-d50bc9155253.tmp
Size 269KB
SHA256 6fbe303478773373221bab90d501f6b302b6e8657f978db41cdb656770ff5ef8
MD5 1f202f4ffc9c7ce111bebb110ba233ba
SHA1 b6f5038b28f56ab010e8fd073ad5ac6120636c2c
SHA512 4ab7879907a75d37191d8cf999de94e9d631ebb20921c7abee46cc101736711c3eacd75b43ee23bb35b2528b139db398b133e8636bd99ab85467292176f7b0d9
SSDEEP 6144:s+loTaLMaW0HtV6FAHb1h+hFD+7t56OD9ZfSApprh:taaLVfV6FAHbLyFSXD9ZfS4v
TLSH
T1DB4423372F59481F8B786815F2ABE505C4356DACC5CE2ADD848A2A47D18FE094373E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f99f5fd-9339-4ed1-b2c0-7008aacc3b41.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4f99f5fd-9339-4ed1-b2c0-7008aacc3b41.tmp
Size 270KB
SHA256 732ce18e182e0b4bcc723b21814f0ecc79ff446d5d1679f2985bce900e934a4c
MD5 9f62d26d59fac54245dcdcbefc017c47
SHA1 4500df5cd17aae0e69e169e3006e5c840e3681d7
SHA512 5cd55cdacb5c4caca9a867830958cd719f413ff76109a496d169cbd8db2e48afce0c7ad7d19a8a23aed0840c3c8251c14d3a7835b8fd4d51a44a6dd5d17e751d
SSDEEP 6144:7CloTaLMaW0HtV6FAHb1h+hFD+7t56OD9ZfSApprh:IaaLVfV6FAHbLyFSXD9ZfS4v
TLSH
T18D4423363E59881F4B746912F29BA604CC346DAEC5CE2ADD888E2D47D18FE094773D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e31d9ef-dac2-4f05-a3bb-9ce38665da32.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7e31d9ef-dac2-4f05-a3bb-9ce38665da32.tmp
Size 269KB
SHA256 00bc1519c73de96537a65214eddc9afec794463b3876bedd32c537d094b74e41
MD5 c1beb56819254390467b46cc3b0094f2
SHA1 d04a36d7f8dc1844c2e562af2ab77fd0b7768039
SHA512 45c507c5f741a991cccdce4c3bbe53f1dad358f66232ead6601787c637566bdef13342ca37ab299b63d740df1b5ec1a5b6c16155ee6bab765afef022c0382034
SSDEEP 6144:7+loTaLMaW0HtV6FAHb1h+hFD+7t56OD9ZfSApprh:kaaLVfV6FAHbLyFSXD9ZfS4v
TLSH
T1254423372F59481F8B786811F2ABE505D4356DACC5CE2ADD848A2A47D18FE094373E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d8069b59ba1cdc110cde92cdc89d02bd5f23941139d79e9234b63999b8afe6ef
MD5 6a6334d09d728c10bd68a9cb97982ddf
SHA1 f0d659e2a7c1287d00edaeb72438749e469f1890
SHA512 056656c470f3886a74d716bf81c288160bf3ac69376a27708f4da95384a73316cb4b9d2af34dba26cad840e42650a59aecb6ae282426b99d8431e86b75a96feb
MD5 SHA1 SHA512

Submit Download

2371b22d-9ca2-462a-8994-6ede8a06ea9c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2371b22d-9ca2-462a-8994-6ede8a06ea9c.tmp
Size 12KB
SHA256 329222857c6d19b7ae08b913b01c77da529c19797fd3c704b5e7704d384cd641
MD5 e9637968040d13bd1e8c4a6795a28ac9
SHA1 037b553848b965682ca24fe6aa4bc37589c9c190
SHA512 28b9e375dd86020ab651628dca60bd5b57ef77d859cf8e69013b8b6feab78544af2b49b1c14b1b58d71f900c51c8e224f9766053e3ebbbc64927f9691e5dec04
SSDEEP 192:GRj1JcONiTSLv7ORPRpOEXsb+WNnCB26XOYbANiyIsnAUgraJ:GRhJ7WuqXvXw82E5e
TLSH
T1FC42D72DB995B97B6CC7D629F9117B53D3F5102124E41E84DAFC892C18EBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a53a1f3-ba7f-4df9-85d6-a4b4d9825ea7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2a53a1f3-ba7f-4df9-85d6-a4b4d9825ea7.tmp
Size 11KB
SHA256 eded43bd6a1e4dc1ce7c1d31a7b550127a530a124841b58e4e6da9f9eb984c03
MD5 eb137e4a5458744ecb460bf2e5103362
SHA1 3066abf82857603e774fa5977038299080157d1e
SHA512 5a1792592a2e2671009761b2d02e03338b4ac61404a5987a8ecc854569da8b3f3cfb2a55a83611a9fa11f53c54e92c60500aa8a541010966f584b910715edc39
SSDEEP 192:GRj1JcONiT3v7O9PRp2EXsb+WNnCB2NXOYbAgiyIsnAUgtaJ:GRhJ7WfGXnXw82Z68
TLSH
T14632C62DB9A4B57B5CCBD229FD217653D3F5106124E42D84DAFC892C18EBACC322751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87ae8ded-10ea-49e2-8c23-88b5e159f857.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\87ae8ded-10ea-49e2-8c23-88b5e159f857.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4edcd4cd-365c-4dcd-b774-f6d6e44e4505.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4edcd4cd-365c-4dcd-b774-f6d6e44e4505.tmp
Size 2KB
SHA256 60e8ca863acfcf59ea88df83dff2e030408503412b882ef7dd9fbf4f4b09f245
MD5 1527d0fb6551fa2e3114246f0919ba4a
SHA1 b92986564aea6e92e63119ebc59059439216de51
SHA512 cf69464db02cf2026656f6d4c6a8c5fb1258fdbfcbbc0f27f5f8ee3cceb26ab965a3de2e53f590fc740fb27873f9657a765290ef9ba3101d77219a71f9449ca3
TLSH
T14F518BB7D3E4967D891156F4AA207E1FCE3E0A15031C3C6288E4AE1B53E2872E25138E
MD5 SHA1 SHA512 TLSH

Submit Download

a5faee83-71ac-42b6-bc92-15663204ce7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a5faee83-71ac-42b6-bc92-15663204ce7a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 3KB
SHA256 143a36664bf6594a49561e7a4c395fb7e1657b8cfa6c82c991af281206b465b6
MD5 b8718b22ba230688eb0191012ee26e13
SHA1 c26fad5b2641deb306acd7773c3f17894629444f
SHA512 cc848a8f7c1be52d0c1ac5b94c14567990167ea1de10c4d815c857111b6cf9d5d061b0c7bdfce006780f4c064e9a7c38d83c2c914fa9c9a3f5a8177dc7af54fa
TLSH
T10761502CD4780DEB1DF27236787D0782FA51936B008118063A7E899D1FB39B38481FAA
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 9a9b93aa0b27121f8067ffc318c02e3cdb8a425f69e844aa987aef6237e4f361
MD5 f9ade1bdb27c14fd7dd30d20270578be
SHA1 3992aced9f348e5ab76db3d0ad564f1d02942db0
SHA512 70991ad43489bdb23949abec65eb14f6e659580af6ef169ad15e335ae6d6934f7d4f49ecd51cb178a9aac45218dec63ed874f90a3963d78b71bfc7137072b756
TLSH
T1E0B0121A80C16301C00103B11550D06E32709F34D1121385C1E00D16E8351D0506B10C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d80a96954c909151124db1829d07c187748d73d143a673a563fdf1be6baeb0ad
MD5 aa04c0789f6b81e88ae424422202ca70
SHA1 295e242c2229713de6bca69de256ada455a9bc8d
SHA512 9b03bb75c6794c1a62a83315af07af0d3817150379ac97d02307299c51319f993051798cca72ae9cf5d1f7bff23a4152b2504b159f29b8492ec1b40426471582
TLSH
T17BB02288C323E32FC00203F028CAA0C830E8EF30CA03020AA2E00E32CC3B2200230030
MD5 SHA1 SHA512 TLSH

Submit Download

a9ff094c-faaa-4532-b41d-f84aac8e422c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a9ff094c-faaa-4532-b41d-f84aac8e422c.tmp
Size 11KB
SHA256 5b68e8706953af858d6a87ce7f82c038ed4f96666ac90c821e658c301d50f3f5
MD5 9bad54900b908d8f32d48f1a3aadcccd
SHA1 9b4356683d1b627fdb402acb3e66895bc928f5a2
SHA512 549868bc9c4cf1546ba1cf35a172f9f44c71a7c87129286e60f0dd303ea2eb62b999cd8a28d413b969523fe590332a007d609bd6bd652ec8555cc5876d6b676b
SSDEEP 192:GRj1JcONiTlv7O9PRp2EXsb+WNnCB2AXOYbALiyIsnAUgraJ:GRhJ7WVGXnXw82m9e
TLSH
T13542D72DB9A5B57B6CC7D229FD217653D3F5102124E42E84DAFC892C18EBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab3ec74f-c244-4f1c-9b23-92f3faa331db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ab3ec74f-c244-4f1c-9b23-92f3faa331db.tmp
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d17edec6-bdce-4be3-8da1-aaaaed54bf1b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d17edec6-bdce-4be3-8da1-aaaaed54bf1b.tmp
Size 414B
SHA256 c59fa7f73ba016ba1327bc6e732faa1d7cd2dc0934aa30ed182b8642eea61711
MD5 b5d467a9b437841098cf10bca457de2a
SHA1 44aeacd86ccbf81859a5912545b86e0e52015d17
SHA512 c8f1b9def3ad721a8b083f02928bc8f54649f1e7542bf81ecb4939458338b1eda1474c1141af7a5bb9fb0f9b5393a56151fe1763a7f14cc762947bfdac2bd137
TLSH
T11BE02BB6C866FC7B19FD5B1D54104B87EB4513573690894F7A3C460D8F7CE36458581C
MD5 SHA1 SHA512 TLSH

Submit Download

f240363f-05cd-4817-bb70-e3ddd4761feb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f240363f-05cd-4817-bb70-e3ddd4761feb.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3228f98-9bf5-4f72-a4ea-8d798742abc0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c3228f98-9bf5-4f72-a4ea-8d798742abc0.tmp
Size 130KB
SHA256 a781c0158d302575662a6856d230782dc97ce26d8ed68926c3019e0f4b2338f4
MD5 423ee530b68bc5c438dded20ee220f58
SHA1 f8040fa6a938b5e20cc609dd47426a57fc4ead2d
SHA512 d26b9e5669c91668d8e4c87eb5ea69da14e08893f205f5d834a0492ec989d707650e98d76b9cec8d0342a8735d5fc9e1108eb2d9b2a737abc9dddfd9affeb20a
SSDEEP 3072:UZ+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UZ+hFD+7t56OD9ZfSApprB
TLSH
T1F9D31232AA91D8BBC9BC6541B157A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\可疑\CR_35988.tmp\setup.exe
Size 6.0MB
SHA256 7d0eb83e7756237c682a115282d3c87458f05ebebf3c02020f0fd879a84f6f35
MD5 e9b4b385da21b86bea78241cd1e3d3e5
SHA1 57bc0fb0f95f33c6b96ee00701b84301273a69f8
SHA512 20df43ca4deddebc12b06f56f0cf3802c0899f38821ab53619014add084cc912264a6e052da6212950b8d719d8e455fabddca9a0b9cddcef386c8506024c9d6d
SSDEEP 49152:73D73oyZWoZVwE/UcGOGmH4vR9JTNnKsCmsl8RJjbILMKQEpqniNrykTsc7Mdh0X:TnniEcNnKrzlMYMKQEpb/623T4XM
TLSH
T112566C53F3B500A8E05ED974CF3956229B757C8B87B092EF269436E11A72DC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 1fbbc70c4afe7a3a9d9805f3492e1832a4b85608161140277cdb455670d246eb
MD5 2cb58279102f31f261b27f640fa2cd8f
SHA1 b624fa5f59c4401abaf042dddf6bc3d4858b95e9
SHA512 130dd6761b25b08072cafd30346935b3c230e10860d3ed47e80aea77be701d2a6da46ecb849f4250491b9c6fd8e7af237238d659f0f8bfa6b8eff5b2ce8da781
TLSH
T1BE41890137F92B59F6F38E326A323B200F7BF817E9658B1D508552980CA6A14498CF7B
MD5 SHA1 SHA512 TLSH

Submit Download