00e70f9c7629871e0cab99b313c3c92913903c18353e1ea3f5b1965fc8044911

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe
Size 1.0MB
Sample261029-23m6dscf72
SHA256 00e70f9c7629871e0cab99b313c3c92913903c18353e1ea3f5b1965fc8044911
MD5 9757f1aa3781cee83164562a587ca1c7
SHA1 b19710c5bfbca87d2136a2eaa5ef074a8230f566
SHA512 654ef0f2ccbe0d198916ddecb5867603fa43d05405ac4d478fa558c38eeffcf9c7036fb5dbaedb6c9e32e4f7e5dae24619a5850d111cd82bd67def5c75204a90
SSDEEP 24576:JNEfAVXcuV4hSE2wJrykiq8+jngFqBMo:7EfqmEMgq8+7vT
TLSH
T1CF354A7AE3D20AFEF489EC3847EC4344B6A964AA07E3125D875B05F7D87724069DAF04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85
PID 3264 set thread context of 4756	3264	Explorer.EXE	85

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2608	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
4756	chrome.exe
4756	chrome.exe
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
4756	chrome.exe
4756	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe
Token: SeShutdownPrivilege	4756	chrome.exe
Token: SeCreatePagefilePrivilege	4756	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4092	2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe
4756	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3264	4092	2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe	55
PID 4756 wrote to memory of 3724	4756	chrome.exe	86
PID 4756 wrote to memory of 2316	4756	chrome.exe	87
PID 4756 wrote to memory of 2316	4756	chrome.exe	87
PID 4756 wrote to memory of 2608	4756	chrome.exe	88
PID 4756 wrote to memory of 4968	4756	chrome.exe	89
PID 4756 wrote to memory of 4968	4756	chrome.exe	89
PID 4756 wrote to memory of 1148	4756	chrome.exe	91
PID 4756 wrote to memory of 2320	4756	chrome.exe	92
PID 4756 wrote to memory of 1148	4756	chrome.exe	91
PID 4756 wrote to memory of 2320	4756	chrome.exe	92
PID 4756 wrote to memory of 4220	4756	chrome.exe	93
PID 4756 wrote to memory of 4220	4756	chrome.exe	93
PID 4756 wrote to memory of 1136	4756	chrome.exe	94
PID 4756 wrote to memory of 1136	4756	chrome.exe	94
PID 4756 wrote to memory of 4396	4756	chrome.exe	99
PID 4756 wrote to memory of 3924	4756	chrome.exe	105
PID 4756 wrote to memory of 2300	4756	chrome.exe	106
PID 4756 wrote to memory of 2836	4756	chrome.exe	107
PID 4756 wrote to memory of 564	4756	chrome.exe	109

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3264
- C:\Users\Admin\AppData\Local\Temp\2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-28_9757f1aa3781cee83164562a587ca1c7_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9219cc728,0x7ff9219cc734,0x7ff9219cc740
    3⤵
    PID:3724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,10181699725192366669,9522978483428950561,262144 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:2316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,9616522269185827045,12630945875490633018,524288 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,14931064522914499212,14310835081774939282,524288 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1688 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,16476820837858843417,17730370140697254734,2097152 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,18362533227246605145,15238027377922612020,2097152 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,165851771275706107,8760392510954769742,2097152 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4248 /prefetch:2
    3⤵
    PID:4220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4592,i,8457397990046221435,12301496556907724256,2097152 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4628 /prefetch:1
    3⤵
    PID:1136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4432,i,7661103941970702160,2248164339017721990,524288 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:4396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,1894854108936432463,13403635870163005241,524288 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5728 /prefetch:8
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,12924855258584690561,10957174528619632627,524288 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5844 /prefetch:8
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,12493564478653109032,15515893772800003652,524288 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:2836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5296,i,1655153638727406530,7099677924287321660,262144 --field-trial-handle=2012,i,2953434204901395332,12350503381193467378,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3025c90f-6291-40f4-ac6b-be964d5d53de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3025c90f-6291-40f4-ac6b-be964d5d53de.tmp
Size 270KB
SHA256 6eea2417a892c6ca27c4d9d35a79f639f347402405bc67ae25640ab4eb77774d
MD5 6fdef600bf3c47cd45093b5a8a5f2d59
SHA1 9e81f0100ecc904da8cc2c9174b15994e67d1831
SHA512 80541de736c96dd193e7f0ec1c62446d0055de19589ba374578aae3da78c496e05986fb2369906683e073d199dca39c897847552556fc20a21da2c0092a06766
SSDEEP 6144:IF3fYHZV9EONkgDLrKQ6087qtBzpiB8+hFD+7t56OD9ZfSApprz:I5wHr9EONBPDxztBzp88yFSXD9ZfS41
TLSH
T1FD441332A95B9DBB8AEC1541904EB3046A659CFB84EF5E4840037FCFE14AD590763D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39da3d8d-8ba2-4d5c-95e5-21106ab5f12b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\39da3d8d-8ba2-4d5c-95e5-21106ab5f12b.tmp
Size 271KB
SHA256 515ba7b283e5615f59adb118c73abdf88606c9685d967275b428eef1ad6c9279
MD5 d774af5f4b86895ebdcf22f99868beb7
SHA1 b5a969858a6aea6a57b3294e9c77957acfec6d80
SHA512 d681f0184c3c3f7f068da428c721af1e1bcd31ae3aaff2e7bfcd2510c1d7b6f6877bab26f69e07afb3f9567a1bb35d4956fc3dfa2728d2c6edaa2a63dd8e0527
SSDEEP 6144:F03fYHZV9EONkgDLrKQ6087qtBzpiB8+hFD+7t56OD9ZfSApprz:2wHr9EONBPDxztBzp88yFSXD9ZfS41
TLSH
T1D0441332A9579CBB8AEC2941904EB3046E559CFB88EF6E4C80037F8FE14A9590753D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b80aef2-e966-4b7f-804c-025e207aaf33.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3b80aef2-e966-4b7f-804c-025e207aaf33.tmp
Size 13KB
SHA256 35122d674ce21d2704b9737f925748d8c02b688930c0467d956a8159e227acb0
MD5 4394b5f812ffd965b7dc5f3439d678b2
SHA1 264ada70f9457b8da5bec33027b66893777ba5da
SHA512 5d502f55f4144ea1934e7cea1665225f6ef28bc3da26439b60b33f5282ba32ec5423b012e86c5ac44f82147233fbf73488762e5ebb44956d06737e311a49e4b7
SSDEEP 192:UR+H6+1rTG3v7+pSPRpI89THsb+WNnhu0ZoCemWu2EVw2dfQVyIsnAUgraJ:UR+H51WfaOXh9wg0i2Wu2EVw2dfUe
TLSH
T14552C52EFE10697B6CEBC669FA627B47D7F5103161941E80E6FC892C15EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

649b37fd-e553-4d50-96a7-3bd6f8742ad3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\649b37fd-e553-4d50-96a7-3bd6f8742ad3.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97e0716e-2fc9-4ccc-b0b0-17639410cf7c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97e0716e-2fc9-4ccc-b0b0-17639410cf7c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

3bd2c2b0-e7f5-4587-a7c9-0c472dea639d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3bd2c2b0-e7f5-4587-a7c9-0c472dea639d.tmp
Size 2KB
SHA256 2d081c150748a5cfc8c4d64f6060e9f317ab83016412fa37bf554c88b2962f1b
MD5 155f03502f7c6f91028ad8c699563434
SHA1 9b7d31ea248428e50f5619a203ba1ffc14602563
SHA512 a8bca1fb064fd00035ad798bc475efecf13c1492b724aa23e4c379c8615f84946c9b5f005cbebea9afbb0e133b48690bb9aa213d30203bb7f731209bc939a457
TLSH
T1FD51ADF3D7E8867D851196F4DB246E1FCE2A0A19131C3C66C9D8AE4B43F2872D20139E
MD5 SHA1 SHA512 TLSH

Submit Download

5ab21ee2-44ad-46bd-a53c-35286818b8fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5ab21ee2-44ad-46bd-a53c-35286818b8fc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 ab2570e04aa246a819329e6a3e35196a12fb0b22f1670315c8d5618cd4bdf374
MD5 2b49b8231d5d2cf9d41a7c7c1021fa8d
SHA1 57b391ab50238fd26ff61aa9cad1abac01d8d60a
SHA512 2f2dbe973ba969a115a9de10eb396fbc0434f03cec2c27183179bba5d1236fea795667c7f4c24ecbf213390852686b2cf5d53013d45e5f7ccc540cb2ae4b89fd
TLSH
T1B4B0124480835311C40202F42160598C3258DF14F7152F0141F01D22D83A151811F468
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e3c25fe698b54f86d818e190126c172f978fab39b5e6abf4b891621273b7b158
MD5 651c9d727ec074f7b9c97a1217cd2797
SHA1 7eea9b5d634a3ab4e787eb7b27befd6deaab19d4
SHA512 c5ad4db2fdbe7853afc42464ce38431602d587419234e20b2b7946dc0f82dab0276efe30b20fcf6e13bc7f8ffeb5ca3cd859e241398a8495ebcb36e7a9f2bd22
TLSH
T129B00255C3136622D08213B02996D9DCB160DF35C7036B17E3E11B7ADC396608A25961
MD5 SHA1 SHA512 TLSH

Submit Download

e317fc05-6aac-4c52-901c-0938101dab81.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e317fc05-6aac-4c52-901c-0938101dab81.tmp
Size 414B
SHA256 07533907850dee310984ae3a4ded2154984cea32ef091b2761acf91b43e636fe
MD5 520d100e175a243f6fc175f43bfac74b
SHA1 85b3943b9361a6957ea0e2d05ba45a62d4752dac
SHA512 fe0ac472dbd20353856b08c1caaea69c8941d0c12378633848d216fa01df69b0900d2d1b3d18c5bb6b2feee88974914a428bc337eec0f5e8cd9f45f5bc89d1a2
TLSH
T1FCE02BFBCA22E82718FD0B5A5451174EE74023972E40494F3B3D81098FF173752C685C
MD5 SHA1 SHA512 TLSH

Submit Download

f33c4169-30e8-42e6-8a79-74ebcb321db9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f33c4169-30e8-42e6-8a79-74ebcb321db9.tmp
Size 12KB
SHA256 1d7a172d5d783c655f310c911d8fda5d23fddd01c849e086b50db7c9b6fe4c39
MD5 3188d5db092d92a175ead3541de3db6e
SHA1 d6ba9f3677f69e246b23d2346ae439c19c6b2f60
SHA512 490fff89f6efd498ecbc2072d724f49568465e0b913ce1c1ae47c6f2e960b5d547b4591f51d9f6b2c5e13f29bc8ef923f68d28cbbcfb9e4eb09d4fcb67e6aa56
SSDEEP 192:UR+Hz+1rTG3v7+pAPRp289THsb+WNnhu0OoCemWu2EVw2dfaVyIsnAUgtaJ:UR+HC1WfaUX79wg0l2Wu2EVw2dfa8
TLSH
T14542A42DBE10657B5CEBC669FE627B57D7F5003161942E80EAFC882C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acd7459f-6a26-4154-a9fa-8c2449b5edde.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\acd7459f-6a26-4154-a9fa-8c2449b5edde.tmp
Size 270KB
SHA256 8ab24b8042aca7c909a0b13e85f34da7aef76dacf39062ad4c1b1da2feb8474e
MD5 af5d11515f05ddb933a4e35d992198a4
SHA1 7d36375c0b0655b66585d506c54fef50306ce179
SHA512 c9c71a0939377f18413c732b4ddba0c56851242b72aa0ef33dc5de5929bff16bb12fdb51e28329e2b0095929b4610dd853a133676b5b49a13ded3db76d5e521f
SSDEEP 6144:5F3fYHZV9EONkgDLrKQ6087qtBzpiB8+hFD+7t56OD9ZfSApprz:55wHr9EONBPDxztBzp88yFSXD9ZfS41
TLSH
T1DD441332A95B9DBB8AEC1541904EB3046A659CFB84EF6E4880037FCFE14AD590763D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db20138b-1164-4858-9761-35b4dc07bce9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\db20138b-1164-4858-9761-35b4dc07bce9.tmp
Size 130KB
SHA256 1fc72a5fd6f29f1fff47188e8333ef36d9d9746825c5400aa043c3d3f3799861
MD5 d1aedb9f61462fbe1d48203a3c38e692
SHA1 b6f59aa0468a5ad35bb18c9b1402fcfc2a941d79
SHA512 ba25e420cab9d3579fb15ecbc5d61eba744cfec987ad3a398cb47b27d6d9559168e81cb1761a040c01674a4bdd4355247e62570bb152b1949f5c3d714d18141c
SSDEEP 3072:W+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:W+hFD+7t56OD9ZfSAppr2
TLSH
T18AD31232AA91D8BBC9BC6541B157A304DE626CED81DE3A09444A5F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-28-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-25-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-22-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-20-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-19-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-18-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-33-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-17-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-12-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-11-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-10-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-9-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-16-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-8-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-23-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-32-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-26-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-76-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-77-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-5-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-29-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-30-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-14-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-13-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-2-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-0-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-1-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-3-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-4-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download

memory/3264-7-0x0000000008F50000-0x0000000008FF2000-memory.dmp

Download