Analysis
-
max time kernel
103s -
max time network
97s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
09-11-2021 15:02
Static task
static1
URLScan task
urlscan1
Sample
http://seogram.unaux.com/seogram/php?key=bdb8914e0e17760c64d80557c4c0cf74779dd744&url_01=https://s3.us-west-002.backblazeb2.com/exsputory-glome-prediscourage/index.html&url_02=https://s3.us-west-002.backblazeb2.com/encheat-gutturize-sensual/index.html&url_03=https://s3.us-west-002.backblazeb2.com/latterkin-outprodigy-unmaker/index.html&url_04=https://s3.us-west-002.backblazeb2.com/bozzetto-kashered-munting/index.html&url_05=https://s3.us-west-002.backblazeb2.com/filariidae-inseminated-managee/index.html&redirect=https://google.com
Behavioral task
behavioral1
Sample
http://seogram.unaux.com/seogram/php?key=bdb8914e0e17760c64d80557c4c0cf74779dd744&url_01=https://s3.us-west-002.backblazeb2.com/exsputory-glome-prediscourage/index.html&url_02=https://s3.us-west-002.backblazeb2.com/encheat-gutturize-sensual/index.html&url_03=https://s3.us-west-002.backblazeb2.com/latterkin-outprodigy-unmaker/index.html&url_04=https://s3.us-west-002.backblazeb2.com/bozzetto-kashered-munting/index.html&url_05=https://s3.us-west-002.backblazeb2.com/filariidae-inseminated-managee/index.html&redirect=https://google.com
Resource
win10-en-20211104
General
-
Target
http://seogram.unaux.com/seogram/php?key=bdb8914e0e17760c64d80557c4c0cf74779dd744&url_01=https://s3.us-west-002.backblazeb2.com/exsputory-glome-prediscourage/index.html&url_02=https://s3.us-west-002.backblazeb2.com/encheat-gutturize-sensual/index.html&url_03=https://s3.us-west-002.backblazeb2.com/latterkin-outprodigy-unmaker/index.html&url_04=https://s3.us-west-002.backblazeb2.com/bozzetto-kashered-munting/index.html&url_05=https://s3.us-west-002.backblazeb2.com/filariidae-inseminated-managee/index.html&redirect=https://google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30922090" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000d796606993bcda1d681cf1cf8f3f7e8d4d6412e9fd38de64a3ce0ba2435106b6000000000e8000000002000020000000d71212c4ff625b13961dc254e60a68687e6c0bbca17032b6db2424cff177a1482000000099ad9f598f2eb528df3a46d83a2482840402684bd4c81f5e250664054797880140000000c318f5fcda9980a876186d3a4e0a4552d0c35d794bbe76ab6354f28283fa5d98eb769ab28daa6add552431a806c8982e10b420818bbec110b3646858b205be39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "343276622" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CB82E68-415D-11EC-B34F-52A244D9E269} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30922090" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1653333116" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343228036" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609866696ad5d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000cb4b29e2e346d2fb03863a75cad7ea15f0fcf31a26b29b1d27ba253da85e47fa000000000e8000000002000020000000d50524087fdbfe2a778d395bbbabe897c683b4c5cb842f3d4e9bfba1ef08b7f3b00100009ffc6a71282116b919eb8691b4398b6e4ce7c00ecccbefe28dd91a83df1132c1997a1412d194d768ffdab77d82d84e29e5462f95e13d6e8707128be8cd51422480864d8a9053ff832bd9a78f46489d80df76c58eedcc6ea3d73977b7c817025b002e4f87c9614bbd0fe39751e73b3e50b27a358ec6683b4f6f3f4cdc3800fb352eb504321e1cb14b8c4f6bdfd5745efc869a75dc2667670179bc4797e89038f104287a2954344dc2884f30d4b5ec02ca37b8fa19e6d14850a0a63f9a3a82b9ed32f06fa9eaccc329c4e4311a0ada05dbe6d5058f25fd2a0ab0ab3b0f39bdc25c7bb9e306452dc6a60d2aba4ed594fe218b77007a62b86e8ae453099731801570a4f09da34c2b12bee42343568a5671e54e73e1df688265808824037a56de8be9b9443f6b2a2fc7f7f4508aef7c5ba63e54cd9e0957558c28544d8a7af6ab71ac9a3e504b226cbc3b9c95c54f2dba9e8641d120353196c039a1218ea6e3bf04f4e3a05e8a8d571e7f705477382a5e4da4fd91cefd903474f798510071445363706223321449fb2067979a9cfcf2955e389a2a3864dee77293ed40e9e54576f085da709c55d0008460a293323e9b1c79b74000000059a43ff19fe1b7e0aa15c1a5926a7d1f388b0dc506943521e110e11f717399b0c7c576eba1bf09affbab7e3d18d9ef04bf108612143dbff6e563abecba11c311 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1638176928" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30922090" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "343244630" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1638176928" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 596 chrome.exe 596 chrome.exe 1952 chrome.exe 1952 chrome.exe 1320 chrome.exe 1320 chrome.exe 1580 chrome.exe 1580 chrome.exe 2972 chrome.exe 2972 chrome.exe 188 chrome.exe 188 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
iexplore.exechrome.exepid process 3872 iexplore.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3872 iexplore.exe 3872 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 3872 wrote to memory of 1720 3872 iexplore.exe IEXPLORE.EXE PID 3872 wrote to memory of 1720 3872 iexplore.exe IEXPLORE.EXE PID 3872 wrote to memory of 1720 3872 iexplore.exe IEXPLORE.EXE PID 1952 wrote to memory of 1692 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1692 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3060 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 596 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 596 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3568 1952 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://seogram.unaux.com/seogram/php?key=bdb8914e0e17760c64d80557c4c0cf74779dd744&url_01=https://s3.us-west-002.backblazeb2.com/exsputory-glome-prediscourage/index.html&url_02=https://s3.us-west-002.backblazeb2.com/encheat-gutturize-sensual/index.html&url_03=https://s3.us-west-002.backblazeb2.com/latterkin-outprodigy-unmaker/index.html&url_04=https://s3.us-west-002.backblazeb2.com/bozzetto-kashered-munting/index.html&url_05=https://s3.us-west-002.backblazeb2.com/filariidae-inseminated-managee/index.html&redirect=https://google.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3872 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0x6c,0xd8,0x7ffbdc9c4f50,0x7ffbdc9c4f60,0x7ffbdc9c4f702⤵PID:1692
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1536 /prefetch:22⤵PID:3060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1848 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:596 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:82⤵PID:3568
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:12⤵PID:1960
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:12⤵PID:1608
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:2844
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:82⤵PID:1180
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3600 /prefetch:82⤵PID:404
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4808 /prefetch:82⤵PID:2564
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4796 /prefetch:82⤵PID:3716
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:82⤵PID:3008
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1320 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵PID:832
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:82⤵PID:2408
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:82⤵PID:1928
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:2972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:864
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:82⤵PID:1300
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1416
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,1263522030025701775,16492899035837955937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\65D3B76E6D5CD07FD87738B1551F1A53MD5
cc65e441ad14b5bc71aee3d138724397
SHA12687f27eb50fcfe6996e36775044c6ac2df31444
SHA256dea27ccf053be8428fee008da90a1a484a845ab98e4df084befde9471e772a0d
SHA51289b5f01a2e8c01b3def30c7323db9ab40041e31e3abd4bfb09dee4a3d4bfcbfeb56f30f2e5a8321b824087b1622512cf9b973b6c28879dcfeb3405c6974069b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
1c3ed22c003b0e1724a802f750244f60
SHA1c83f95230ea4d3ac58c4f5d5a7504b0f5eedf0ad
SHA256f24de6edda835df45daadcce85ecfeaa1f5a363a16faeff1c16ae55ec57dcb6b
SHA5127f9f0395307b63d4bda636b132533f5e62b36bfa78ff0850c5ba0a2ebe3f426b0a18232993a35bfe9166d9f86d2dfe2ad6429fc864265a0bdf6d4f1f25d26297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
60f61b99340f698779f7dfee4eb536f7
SHA199c8cd0d77c0a8bc2b2a28365615688e8e70eed5
SHA256c0c1947de9005d87d61ddd812f733631ec3e01576b6f64b69e904e9d9bb6cd0e
SHA5121bb4ebc9f6ce2cbb08073e6619a038e23f88c6a59de0016fe332d9baef57666ef9125734a8397ca0faf30ec888a98345edd988d778ee0ceef55e0047970e3627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\65D3B76E6D5CD07FD87738B1551F1A53MD5
54be7b95423bb227fa681d84e08288b5
SHA13e6887b857cc1c592cfc79a97133a8fdd08f561e
SHA256fa93188d51969cdfb2725514d6cdff24d92274d1e07edc1347821e72011ea989
SHA512d43bd3fc74d706e1d88c9bed460439974f2c2407271f8e70c0cfdcb6f570ae3cd850c7e227362e2ed4f71edf9e26e64cbebcb1823fe87d471333b2e1f3292f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
bf3b86a22386054d642a4cb550150888
SHA18eebf3abd92290c65edacc2913ea84f7b49a2e4d
SHA2563ab83b68063ae2704b3166723b33ff8926d3d31b1e1c1499483683d13c1866a5
SHA512081a199cdbb98d5e88b08a11e0b7ec5eadbd6609bfdbe313da0ca10b10fcdade623710eb2a6d603819d036f3dfd75fc68389c4fbca7eba306bb681712d1c8c00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7BWWV3FP.cookieMD5
437f1de8c2b67d447989450cd9d03c3f
SHA11c16deefd783e96d7bf98c53380781dcb976379c
SHA2565c0df2a8d277b9056814ce1b28a622b00c8be747fd0d713eafd6689566473846
SHA5127dd7e4d63836b989d6616506f5bdd04545e9bcd8528bbbf51e00e4ce9974909b2d90ff755c3bdd8c2e6bcf5ad19466868779b6f7007a24289b100c4ac4ec2992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\OGS4CX9A.cookieMD5
35e13065a18890a111915d28708eb6a6
SHA13e30ba4641af496d31e64e1cacaf3c0a813b5fe8
SHA256fbae405d1dadd457bb67268752808ac78f384011592180ac9514b41d5a514ca0
SHA512100a4e6c9e860cd7c00e28383602aa318e78632d91c2d1735b266048d334f8be8c2bbc854eea2a3e190a33b30197509965d487a58592851f35352d3a4242d57e
-
\??\pipe\crashpad_1952_QPCDZZPQWXGANKCZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1720-143-0x0000000000000000-mapping.dmp
-
memory/3872-145-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-153-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-126-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-127-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-128-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-130-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-131-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-132-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-134-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-135-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-136-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-138-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-139-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-140-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-141-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-144-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-124-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-147-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-148-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-150-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-152-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-125-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-154-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-158-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-159-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-160-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-166-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-167-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-168-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-169-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-170-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-171-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-172-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-123-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-122-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-120-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-119-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-118-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-173-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-174-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-178-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB
-
memory/3872-181-0x00007FFBED240000-0x00007FFBED2AB000-memory.dmpFilesize
428KB