Resubmissions
05-12-2020 00:17
201205-6cw1vqdsze 705-12-2020 00:13
201205-184e856542 705-12-2020 00:10
201205-7h2wyzrtwj 7Analysis
-
max time kernel
88s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-12-2020 00:13
Static task
static1
Behavioral task
behavioral1
Sample
222.rtf
Resource
win7v20201028
Behavioral task
behavioral2
Sample
222.rtf
Resource
win10v20201028
General
-
Target
222.rtf
-
Size
558B
-
MD5
12cd195006a94bf0b4fadab0f247983d
-
SHA1
c4c5a9e84ee9d42f6bebbaabf9f690c0e146467e
-
SHA256
54f4d9d9a35e226a25c1e0f7c1ff5bdd9a62ecfb51efa90ce81f48cb46be416d
-
SHA512
54eacc3ea2a45a1512c45185432d6cc478d4109f5368daff6b2e73c248e196158fed7d2a296b23a29c4a25827585bfd7d7538d47ac8928a2a1ff80a70618eab4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 4 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_metadata\computed_hashes.json chrome.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_metadata\computed_hashes.json chrome.exe File opened for modification C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp chrome.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_metadata\computed_hashes.json chrome.exe -
Drops file in Program Files directory 2 IoCs
Processes:
chrmstp.exedescription ioc process File created C:\Program Files\Google\Chrome\Application\SetupMetrics\18ddecdb-0a5c-479e-9504-4a1bd6e9cac7.tmp chrmstp.exe File opened for modification C:\Program Files\Google\Chrome\Application\SetupMetrics\20201205011132.pma chrmstp.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exeWINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 540 WINWORD.EXE 540 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exepid process 3008 chrome.exe 3008 chrome.exe 584 chrome.exe 584 chrome.exe 4672 chrome.exe 4672 chrome.exe 4544 chrome.exe 4544 chrome.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
chrome.exepid process 584 chrome.exe 584 chrome.exe 584 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 540 WINWORD.EXE 540 WINWORD.EXE 540 WINWORD.EXE 540 WINWORD.EXE 540 WINWORD.EXE 540 WINWORD.EXE 540 WINWORD.EXE -
Suspicious use of WriteProcessMemory 1249 IoCs
Processes:
firefox.exechrome.exedescription pid process target process PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 1344 wrote to memory of 904 1344 firefox.exe firefox.exe PID 584 wrote to memory of 4052 584 chrome.exe chrome.exe PID 584 wrote to memory of 4052 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 2688 584 chrome.exe chrome.exe PID 584 wrote to memory of 3008 584 chrome.exe chrome.exe PID 584 wrote to memory of 3008 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe PID 584 wrote to memory of 3856 584 chrome.exe chrome.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\222.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff80a246e00,0x7ff80a246e10,0x7ff80a246e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1664 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1712 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x1f8,0x248,0x7ff76c2b7740,0x7ff76c2b7750,0x7ff76c2b77603⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3408 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3508 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3952 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1944 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=832 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6136 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3568 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3832 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6940 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7152 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4012 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6832 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5152 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,6960370898015791488,14618697873183045726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
8942391dad90942073135bbadad8e006
SHA199d82f38d5609dbf6ec26e63277db1a92eda97a7
SHA256d1fef3bf99e0d3680acfa6e08597b8beb5309a97945dba4df379551265ee7f39
SHA51216125898fe0d01c3ed5a12f976845037e7d1ffc1a876bdb34cd04223b2bcae0d95bab051205a9b22f7f068b6d134a5fb11ba84743eec21f5c828536c67701661
-
\??\pipe\crashpad_584_CKHGZYVYAUQHTOYVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/492-243-0x0000000000000000-mapping.dmp
-
memory/540-3-0x00007FF806A60000-0x00007FF809583000-memory.dmpFilesize
43.1MB
-
memory/540-4-0x00007FF806A60000-0x00007FF809583000-memory.dmpFilesize
43.1MB
-
memory/540-5-0x00007FF806A60000-0x00007FF809583000-memory.dmpFilesize
43.1MB
-
memory/540-2-0x00007FF8052D0000-0x00007FF805907000-memory.dmpFilesize
6.2MB
-
memory/584-145-0x00000215C5080000-0x00000215C5081000-memory.dmpFilesize
4KB
-
memory/744-173-0x0000000000000000-mapping.dmp
-
memory/748-213-0x0000000000000000-mapping.dmp
-
memory/904-6-0x0000000000000000-mapping.dmp
-
memory/1308-74-0x0000000000000000-mapping.dmp
-
memory/1928-170-0x0000000000000000-mapping.dmp
-
memory/2028-189-0x0000000000000000-mapping.dmp
-
memory/2204-208-0x0000000000000000-mapping.dmp
-
memory/2480-184-0x0000000000000000-mapping.dmp
-
memory/2588-196-0x0000000000000000-mapping.dmp
-
memory/2688-70-0x00007FF8259D0000-0x00007FF8259D1000-memory.dmpFilesize
4KB
-
memory/2688-68-0x0000000000000000-mapping.dmp
-
memory/2972-168-0x0000000000000000-mapping.dmp
-
memory/3008-69-0x0000000000000000-mapping.dmp
-
memory/3096-91-0x0000203200040000-0x0000203200041000-memory.dmpFilesize
4KB
-
memory/3096-76-0x0000000000000000-mapping.dmp
-
memory/3096-108-0x00000234D1E70000-0x00000234D1E71000-memory.dmpFilesize
4KB
-
memory/3140-242-0x0000000000000000-mapping.dmp
-
memory/3856-71-0x0000000000000000-mapping.dmp
-
memory/4052-62-0x0000000000000000-mapping.dmp
-
memory/4160-109-0x000001B028F20000-0x000001B028F200F8-memory.dmpFilesize
248B
-
memory/4160-80-0x0000000000000000-mapping.dmp
-
memory/4160-90-0x00002BC900040000-0x00002BC900041000-memory.dmpFilesize
4KB
-
memory/4160-134-0x000001B028F20000-0x000001B028F200F8-memory.dmpFilesize
248B
-
memory/4160-124-0x000001B02AD40000-0x000001B02AD41000-memory.dmpFilesize
4KB
-
memory/4168-156-0x0000000000000000-mapping.dmp
-
memory/4176-129-0x00000140CD1D0000-0x00000140CD1D00F8-memory.dmpFilesize
248B
-
memory/4176-81-0x0000000000000000-mapping.dmp
-
memory/4176-118-0x00000140CEFE0000-0x00000140CEFE1000-memory.dmpFilesize
4KB
-
memory/4176-92-0x000022A600040000-0x000022A600041000-memory.dmpFilesize
4KB
-
memory/4176-106-0x00000140CD1D0000-0x00000140CD1D00F8-memory.dmpFilesize
248B
-
memory/4192-130-0x000001BB067A0000-0x000001BB067A00F8-memory.dmpFilesize
248B
-
memory/4192-117-0x000001BB085B0000-0x000001BB085B1000-memory.dmpFilesize
4KB
-
memory/4192-107-0x000001BB067A0000-0x000001BB067A00F8-memory.dmpFilesize
248B
-
memory/4192-83-0x0000000000000000-mapping.dmp
-
memory/4192-93-0x00007FFB00040000-0x00007FFB00041000-memory.dmpFilesize
4KB
-
memory/4204-223-0x0000000000000000-mapping.dmp
-
memory/4216-191-0x0000000000000000-mapping.dmp
-
memory/4240-94-0x0000045900040000-0x0000045900041000-memory.dmpFilesize
4KB
-
memory/4240-85-0x0000000000000000-mapping.dmp
-
memory/4240-133-0x00000172F1200000-0x00000172F12000F8-memory.dmpFilesize
248B
-
memory/4240-111-0x00000172F1200000-0x00000172F12000F8-memory.dmpFilesize
248B
-
memory/4240-123-0x00000172F30B0000-0x00000172F30B1000-memory.dmpFilesize
4KB
-
memory/4304-198-0x0000000000000000-mapping.dmp
-
memory/4308-204-0x0000000000000000-mapping.dmp
-
memory/4344-226-0x0000000000000000-mapping.dmp
-
memory/4356-221-0x0000000000000000-mapping.dmp
-
memory/4436-201-0x0000000000000000-mapping.dmp
-
memory/4444-277-0x000002954D6A0000-0x000002954D6A1000-memory.dmpFilesize
4KB
-
memory/4444-257-0x000002954B890000-0x000002954B8900F8-memory.dmpFilesize
248B
-
memory/4444-238-0x0000000000000000-mapping.dmp
-
memory/4444-284-0x000002954B890000-0x000002954B8900F8-memory.dmpFilesize
248B
-
memory/4444-254-0x000049E800040000-0x000049E800041000-memory.dmpFilesize
4KB
-
memory/4544-102-0x0000000000000000-mapping.dmp
-
memory/4544-164-0x0000000000000000-mapping.dmp
-
memory/4588-232-0x0000000000000000-mapping.dmp
-
memory/4612-245-0x0000000000000000-mapping.dmp
-
memory/4632-217-0x0000000000000000-mapping.dmp
-
memory/4672-182-0x0000000000000000-mapping.dmp
-
memory/4672-115-0x0000000000000000-mapping.dmp
-
memory/4680-203-0x0000000000000000-mapping.dmp
-
memory/4680-263-0x00000190682F0000-0x00000190682F00F8-memory.dmpFilesize
248B
-
memory/4680-218-0x0000267E00040000-0x0000267E00041000-memory.dmpFilesize
4KB
-
memory/4680-235-0x00000190682F0000-0x00000190682F00F8-memory.dmpFilesize
248B
-
memory/4680-250-0x000001906A500000-0x000001906A501000-memory.dmpFilesize
4KB
-
memory/4684-210-0x0000000000000000-mapping.dmp
-
memory/4708-247-0x0000000000000000-mapping.dmp
-
memory/4768-120-0x0000000000000000-mapping.dmp
-
memory/4780-165-0x0000000000000000-mapping.dmp
-
memory/4792-177-0x0000000000000000-mapping.dmp
-
memory/4804-252-0x0000000000000000-mapping.dmp
-
memory/4860-175-0x0000000000000000-mapping.dmp
-
memory/4872-215-0x0000000000000000-mapping.dmp
-
memory/4936-180-0x0000000000000000-mapping.dmp
-
memory/4964-147-0x0000000000000000-mapping.dmp
-
memory/4976-148-0x0000000000000000-mapping.dmp
-
memory/4980-194-0x0000000000000000-mapping.dmp
-
memory/4988-271-0x0000000000000000-mapping.dmp
-
memory/5000-150-0x0000000000000000-mapping.dmp
-
memory/5024-187-0x0000000000000000-mapping.dmp
-
memory/5040-151-0x0000000000000000-mapping.dmp
-
memory/5064-230-0x0000000000000000-mapping.dmp
-
memory/5088-236-0x0000000000000000-mapping.dmp
-
memory/5092-251-0x0000014ABC840000-0x0000014ABC8400F8-memory.dmpFilesize
248B
-
memory/5092-239-0x00002DFF00040000-0x00002DFF00041000-memory.dmpFilesize
4KB
-
memory/5092-262-0x0000014ABF2B0000-0x0000014ABF2B1000-memory.dmpFilesize
4KB
-
memory/5092-280-0x0000014ABC840000-0x0000014ABC8400F8-memory.dmpFilesize
248B
-
memory/5092-225-0x0000000000000000-mapping.dmp
-
memory/5108-153-0x0000000000000000-mapping.dmp