2eefa765980ba35c50047822903895501061062d17cccc296edd2ae8df3e5099

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe
Size 1.1MB
Sample261024-dybd2ahv5p
SHA256 2eefa765980ba35c50047822903895501061062d17cccc296edd2ae8df3e5099
MD5 9ac1869934ee3fa7882c4cbdb75a2f55
SHA1 ca53c9d48a0357482ec9bbbe2073da0d4bc79ac6
SHA512 ef51dab57081b0533c913f913a85439909aa18e2c74f9b3738d60f36fc5d8d7e9f1b1a160475be17d825964a7b7c20db503c09435d25c333516801e6a6f28bf5
SSDEEP 24576:0VdORUV3AiN6MsohGLL7mgppQtaM2wrh6fOpCp:wAasbktx2Yk
TLSH
T1C145E061F3953EF5F42A85F08971E1028A31BC151BD01AFBA28C17DB4D32AD1BBFA615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 23 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84
PID 3264 set thread context of 1636	3264	Explorer.EXE	84

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\cogitate\mcgaindeiag.pdf	2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe
File opened for modification	C:\Program Files\Git\eendaotz	2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
1636	chrome.exe
1636	chrome.exe
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
1636	chrome.exe
1636	chrome.exe
4412	chrome.exe
4412	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
840	2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3264	840	2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe	56
PID 1636 wrote to memory of 4636	1636	chrome.exe	85
PID 1636 wrote to memory of 376	1636	chrome.exe	86
PID 1636 wrote to memory of 376	1636	chrome.exe	86
PID 1636 wrote to memory of 4644	1636	chrome.exe	87
PID 1636 wrote to memory of 2064	1636	chrome.exe	88
PID 1636 wrote to memory of 2064	1636	chrome.exe	88
PID 1636 wrote to memory of 4728	1636	chrome.exe	90
PID 1636 wrote to memory of 4728	1636	chrome.exe	90
PID 1636 wrote to memory of 1828	1636	chrome.exe	91
PID 1636 wrote to memory of 1828	1636	chrome.exe	91
PID 1636 wrote to memory of 3500	1636	chrome.exe	92
PID 1636 wrote to memory of 3500	1636	chrome.exe	92
PID 1636 wrote to memory of 2248	1636	chrome.exe	93
PID 1636 wrote to memory of 2248	1636	chrome.exe	93
PID 1636 wrote to memory of 1096	1636	chrome.exe	96
PID 1636 wrote to memory of 2592	1636	chrome.exe	104
PID 1636 wrote to memory of 4228	1636	chrome.exe	105
PID 1636 wrote to memory of 2752	1636	chrome.exe	106
PID 1636 wrote to memory of 4412	1636	chrome.exe	108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3264
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9ac1869934ee3fa7882c4cbdb75a2f55_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7cb0c728,0x7fff7cb0c734,0x7fff7cb0c740
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,15773766312691241660,10822221719774166548,262144 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13942577312040064920,15975972598501288185,524288 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,8904518299908267615,14349647579479009486,524288 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:2064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,4883934358396851821,15510269066793742684,2097152 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,11080751451632864871,10764772695424667876,2097152 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,631236757478560258,9936261130108891491,2097152 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4356 /prefetch:2
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4488,i,8416591012457285621,12914236617682110646,2097152 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,11837698954467019149,14417817210267377658,524288 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:1096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,4792768931378081310,6639080150554580203,524288 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5816 /prefetch:8
    3⤵
    PID:2592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,13519861809434732871,11584773440653911244,524288 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,45813747134692957,17860539205959765030,524288 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1048,i,14986985538446101652,17607061032605862308,262144 --field-trial-handle=1992,i,2905763633580853697,12954037415443155983,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0b333023-04b5-474d-970a-6ee1e9491651.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0b333023-04b5-474d-970a-6ee1e9491651.tmp
Size 270KB
SHA256 42f0c6bb2ae34a326d86007c5dddee54375e62e5b698c4a9a2b98e50bc2e1efb
MD5 c0077483d445cfb6194f3969f84bd91d
SHA1 29fdd5ecdb854ec90c031467095a9fef973d11b8
SHA512 309314fd465cf74a569e72203468f93f8cd9acf1cebd1292ae7fa8a78542cbada7ec6a41f8f5a53d2c1fb6e131381c8022f2b3d2fddafd94205f832b8936b5f0
SSDEEP 6144:YnWY0fjg4IO2RfjGC83LGJpmU+hFD+7t56OD9ZfSApprn:pfjPjC5JpTyFSXD9ZfS4x
TLSH
T1A14423732868B877CFE91A16B20B3B04CE956CFF448D8E85C4549F8B51572694B13F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e080fa1-86da-4edc-87b7-2573def88f73.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2e080fa1-86da-4edc-87b7-2573def88f73.tmp
Size 269KB
SHA256 53f023fb9474d7aaed7b0ec1c319dce5b17369dd441b4fbad2f95c33376ea833
MD5 6f1d74671c691a78d0e78a00c0271b5b
SHA1 41900e726ae35b3a4c701a5ecb6a5034fbef5048
SHA512 d85fc76e53af263663482893badee5d2a86fb9ea10a18162920539563198d9c9418bb7e091314674c29ad350146e039618dfda08a5ee0db48801d523c65d1fec
SSDEEP 6144:P9WY0fjg4IO2RfjGC83LGJpmU+hFD+7t56OD9ZfSApprn:PUfjPjC5JpTyFSXD9ZfS4x
TLSH
T1784423B32968A877CFED1A17B20B3B04CE552CFF408E8E81C4659BCB51576694713B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

976fb758-ca80-44bd-ad3e-ab0404bf3939.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\976fb758-ca80-44bd-ad3e-ab0404bf3939.tmp
Size 269KB
SHA256 276b4b628a6aab097e3e6460b729738e15324d01167bd079e01a853ea0c61ea0
MD5 e0cd019437efe62dac85d6ff3c06243a
SHA1 bf5b063e45b0cc97a495f689ff6cb271a65d5787
SHA512 368020a5de69826a360e962287cb89b6bae6467e150186d80f2e910d27f5458faf45890a3093350cdbcb53fb84cd080e032fc363a8d5a561e7a39ba2316c9cb0
SSDEEP 6144:29WY0fjg4IO2RfjGC83LGJpmU+hFD+7t56OD9ZfSApprn:2UfjPjC5JpTyFSXD9ZfS4x
TLSH
T1474423B32968A877CFED1A17B20B3B04CE552CFF408E8E81C4659BCB51576694713B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48ba9ee4-2bdd-444e-aeee-1437cae94510.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\48ba9ee4-2bdd-444e-aeee-1437cae94510.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56e6722b-484a-4dcd-b94b-82f087e19b49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56e6722b-484a-4dcd-b94b-82f087e19b49.tmp
Size 414B
SHA256 408cb0f70fe3cd47fd7be64f29c4d2a1944036152bcbf91a69a392cd06344149
MD5 bec8a1fbc5011649f56fd218bd5db6e3
SHA1 b78aca8f8b63400d53054002138c6d2d7e9c9c73
SHA512 5af2de451ce3e7c8f3a568d70b9142ae3790c7284cab345ec84f6c57b67980cb324d8d39933cf579bff3e77cf9471b22d327715cee02f28273bae89a10dcec42
TLSH
T197E0E5EACA22E82718FD0B5D10514649EA4013662A50494F3A3D81088FF163602D586C
MD5 SHA1 SHA512 TLSH

Submit Download

5e2d8f69-eea6-4d3d-94d5-ca3d48037239.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e2d8f69-eea6-4d3d-94d5-ca3d48037239.tmp
Size 12KB
SHA256 c9fd51c10dc2be02d8d5fbae989dbc2fffa49e4f400c0421c5259c4820093f52
MD5 fe607754adfb9e43410bf44131a89188
SHA1 d5aea9728c195d2882962a9a99c7348390c9c8a1
SHA512 f146d1a9d85fdd7a13c78099c008913855d356c4ca13a57e389c562d8fdf23b2f9eebdf04280609d8343bcc500c699c82b02cfaeaf1ff8b51a6ecd8bcb69d1f2
SSDEEP 192:UR6XcckikEpMv7+pAPRp289THsb+WNnF60Sv2Bro9+VyIsnAUgtaJ:UR6XewYaUX79wM0025828
TLSH
T1DB42B42DBA50753B9CEBD22AF9217757DBF6103164A42E88E6FC893C14EB5DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

744849b2-b44d-4da9-93ec-c8100ce49bfa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\744849b2-b44d-4da9-93ec-c8100ce49bfa.tmp
Size 12KB
SHA256 5165aa0c86ccb462feed657db3b51a09168743ad4a97c39681dda87c87492c2e
MD5 b95d200da6c30b4f610988c2cfbee0e8
SHA1 e9b2760c3b50e597fd5466a353f28423bd5f0f1e
SHA512 924c632c2525e8059c23922bd5abb85f9782f6acb4dd1c56b2078f8c373600b2c4361babf2371055c5aa52cc28cce2d78fb042a02ed1d066fcef5f6c465147a0
SSDEEP 192:UR6XockikEpMv7+pAPRp289THsb+WNnF60fv2Brol+VyIsnAUgraJ:UR6XKwYaUX79wM032582e
TLSH
T12B42B42DBA50793B9CEBD22AF9217B57DBF6103164A42E84E6FC893C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc4b1e31-120d-473f-b2ac-09c0bbecd133.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bc4b1e31-120d-473f-b2ac-09c0bbecd133.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f1d9baa9-d01d-40fa-b24a-177160effcc5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f1d9baa9-d01d-40fa-b24a-177160effcc5.tmp
Size 2KB
SHA256 eb9677993395d52ca7ac84375c5da2eeeb8840515b57c57355be7e4870d7d451
MD5 93068ae6c64cf246add2b275eb548317
SHA1 4a6a63c07f42367874046c7c8014ade665746144
SHA512 1e920e4d2fb5f356be80246ddea8a23adc73ff0bdf4d1b868cfc5fcedb8081c02e4bf6a80bc7c78ab747faccb7d3f6b003057487a78584d802ce585a1afdc4e3
TLSH
T195518DF7D7E4957DC91196F8EB217E1FCD2D0A14022C3C6688D4AE5B93E2972D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 50abe4e72118b64a5e0a6da496f571654b2c3bf3a8d8548595d5261de890b580
MD5 c8cf42db341cccf5f22fd63827840cb9
SHA1 1a7af8ebc92cdd1ea4169b462f98b0b3b20de0c4
SHA512 542678b4e81fba4d06afd66b0257bb1feb2958789fd2cd0120ce7b0dbfcf5c6ce9c941b6a0f0664801e6cc65bbb33c98c7b342aed6c93d8bdd11df300a38345f
TLSH
T12DB0124580835302C00212F4119454C8365CEF10A6051301B1F45E11C835150A05F058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 fc7374ce8a6dec919ec4855177a7868e6efa9fa95b091846794bebfc75b75612
MD5 bfe67e9131e499812288786673c5d774
SHA1 1808157da95434e7628bcca052ebed6ae55b3302
SHA512 d8cbf895eb70f28d6030651349f8893b4f9eb6aefbd9e247bbced980c6090d01af31e03d0f7c3bb5570123fe23c8aef6d5bedb1d9773c20e1d54fa05f0505a16
TLSH
T175B02280C0032302E00203B838C0C0C83030EF20C2030302E3E00E3ACC202A000388B0
MD5 SHA1 SHA512 TLSH

Submit Download

b414709f-3aec-475a-8506-fb145bed08a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b414709f-3aec-475a-8506-fb145bed08a4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eaf5c36d-bcab-4a07-b919-6d7020133837.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eaf5c36d-bcab-4a07-b919-6d7020133837.tmp
Size 130KB
SHA256 ec7a8dcfc3d8357242d37fcaa6bf045843bc54dd4ea84f19add8a6b248395c96
MD5 0edcabf331b1450b4895f34d579e6291
SHA1 7cbc96af6d0c27588223e5a298fd21a878b77f4c
SHA512 d367d8d3ab5e0ced477a53ce1ec178081fbbb1b007f0911223ce17a5256072b0072e45eaee566e963da0367265d229d1a04c7d62e56e53f2af26cf123b7b68ad
SSDEEP 3072:j+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:j+hFD+7t56OD9ZfSAppr2
TLSH
T15AD312326A91D8BBC9BC6541B157A304DE726CED81DE3A0944495F8ED09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-29-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-23-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-20-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-19-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-18-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-27-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-22-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-25-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-21-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-10-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-8-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-16-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-9-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-30-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-31-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-15-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-24-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-26-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-6-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-12-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-84-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-11-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-13-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-1-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-0-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-2-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-3-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-4-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-5-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download

memory/3264-7-0x0000000002E30000-0x0000000002ECE000-memory.dmp

Download