b923705e84ac6e19bc99d3143a45359c1e8931adae6035f483d6b0530291feac

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-en-20211014
submitted
24-11-2021 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

000eb9dc718e2e88cced9af6803c45cd.pdf
Size

93KB
MD5

000eb9dc718e2e88cced9af6803c45cd
SHA1

32a8f695af83b5e5bbb7e9fb566d0818f1c4c966
SHA256

f0ca5884c6b874674af18760f2f91ff7043c8a962b440ff0fa3069caa712c447
SHA512

800e00a77719007587340d2c335af3754f82dde062f4b9c031ff0a12f189d3417199fa571c61d998023a13c8923ab49aa194d7f1487d0ba69a6c6c2ffafec8a7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "344491407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11C1C2B1-4CDB-11EC-849C-56C624790606} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb19360000000002000000000010660000000100002000000049779fadbde462a346c03d337286b412b93dcd23f0ac34ceca4c4559e2e08c61000000000e80000000020000200000003fa05697aea7dda4414fccd61a68b20b934964cb5d699c2f3ae68413e4d925e89000000093564e9f0b8ba1c640c96230ca518e0bd1e248e86473ec14ce97b3db5a25fab5af7f6b96adfc2cda7ae564b57a3594bc303dac15021e09b975f7402815f1f80ef342ffce953807b9c3450f99646d4867d0c490a838457ba0ce9c66e1b18da0110d03b0226c824dd7cd7ecd6f3c762acb78c950e86e6acccebd2dda2df44a867f93e791ff0d9f3285363af77cece2529940000000538fbc54b9369e79706decdf0077824fbc385fe7cc583a67456ac1f452ff58d714381e4dc1bf9092345e4a084b3e88c588d0ed5ef2a4cb9b14dec614d91c7c14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb193600000000020000000000106600000001000020000000635f0c7ca714a5e3233636b3b0e8981fabe5da7378c306927f9271e890f9a908000000000e8000000002000020000000e401b3e4a5b2885dda64409844c9782ec4e49759e624ecd1565bd9fa0efab8bd2000000039186fbb7d53faa8e242913d7c68c7f3f7501c59f9badac7f34dd79fb80ccd8440000000538b4fb689a7fcb7301b90570f3dc23c6731e29f49c383155442c54c64e1ca0320a2b319050c49b9dfb92dabb4db2a8a25cadfebb91654347c2a016436509338	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20013edbe7e0d701	iexplore.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid process

1996 chrome.exe
1900 chrome.exe
1900 chrome.exe
2692 chrome.exe
3064 chrome.exe
2724 chrome.exe
2468 chrome.exe
2920 chrome.exe
2356 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1088 AcroRd32.exe

pid	process
1996	chrome.exe
1900	chrome.exe
1900	chrome.exe
2692	chrome.exe
3064	chrome.exe
2724	chrome.exe
2468	chrome.exe
2920	chrome.exe
2356	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	3024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3024	AUDIODG.EXE
Token: 33	3024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3024	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

iexplore.exechrome.exe

pid	process
716	iexplore.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
1088	AcroRd32.exe
1088	AcroRd32.exe
1088	AcroRd32.exe
1088	AcroRd32.exe
716	iexplore.exe
716	iexplore.exe
960	IEXPLORE.EXE
960	IEXPLORE.EXE
960	IEXPLORE.EXE
960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeiexplore.exechrome.exe

description	pid	process	target process
PID 1088 wrote to memory of 716	1088	AcroRd32.exe	iexplore.exe
PID 1088 wrote to memory of 716	1088	AcroRd32.exe	iexplore.exe
PID 1088 wrote to memory of 716	1088	AcroRd32.exe	iexplore.exe
PID 1088 wrote to memory of 716	1088	AcroRd32.exe	iexplore.exe
PID 716 wrote to memory of 960	716	iexplore.exe	IEXPLORE.EXE
PID 716 wrote to memory of 960	716	iexplore.exe	IEXPLORE.EXE
PID 716 wrote to memory of 960	716	iexplore.exe	IEXPLORE.EXE
PID 716 wrote to memory of 960	716	iexplore.exe	IEXPLORE.EXE
PID 1900 wrote to memory of 1284	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1284	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1284	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1984	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1996	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1996	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1996	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe
PID 1900 wrote to memory of 1988	1900	chrome.exe	chrome.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\000eb9dc718e2e88cced9af6803c45cd.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=the+sanford+guide+to+antimicrobial+therapy+2020+pdf+download
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:716 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d94f50,0x7fef6d94f60,0x7fef6d94f70
2⤵
PID:1284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1124 /prefetch:2
2⤵
PID:1984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1736 /prefetch:8
2⤵
PID:1988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
2⤵
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
2⤵
PID:2160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:8
2⤵
PID:2324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2356 /prefetch:2
2⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
2⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:8
2⤵
PID:2504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3128 /prefetch:8
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3976 /prefetch:8
2⤵
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:8
2⤵
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3608 /prefetch:8
2⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:8
2⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:2796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3312 /prefetch:8
2⤵
PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4136 /prefetch:8
2⤵
PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1120 /prefetch:8
2⤵
PID:2952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3960 /prefetch:8
2⤵
PID:3000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4088 /prefetch:8
2⤵
PID:2992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
2⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
2⤵
PID:2580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
2⤵
PID:2680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3172 /prefetch:8
2⤵
PID:2668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:8
2⤵
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3368 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,14332679998812927264,15119790585765366329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_the+sanford+guide+to+antimicrobial+therapy+2020+pdf+download (1).zip\Setup\password-is-237385.txt
1⤵
PID:2992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
54e9306f95f32e50ccd58af19753d929

SHA1
eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

SHA256
45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

SHA512
8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
61924384767e54a87b576d39e0b292f2

SHA1
67bc45a379ae5e380fd30864624938fb316725cb

SHA256
2387db0517e8b8f99aa32b1a15dd7c56d5159d999f2114307b48f8e1c99757c4

SHA512
104376891523c941fde3f7cc742a34ba10ddd01123d3e86f3d7c34853057f6071cacb51a9eb8646fa2aedb723b14c6e93c6efc3a0bf80953e2a0b68dd60e0881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
acaeda60c79c6bcac925eeb3653f45e0

SHA1
2aaae490bcdaccc6172240ff1697753b37ac5578

SHA256
6b0ceccf0103afd89844761417c1d23acc41f8aebf3b7230765209b61eee5658

SHA512
feaa6e7ed7dda1583739b3e531ab5c562a222ee6ecd042690ae7dcff966717c6e968469a7797265a11f6e899479ae0f3031e8cf5bebe1492d5205e9c59690900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_236E243F97CD352248042AF77144B4DB
MD5
096510bb36dbcd45c70acf440faa471e

SHA1
7ae28e4b94601c98b6f613e6af6caa6b1c167c50

SHA256
513a3c47cbc0a144df61276423dc104226fa481c5461a7c28f92b226262981fb

SHA512
66dbbd307dfc3cf3a98c0ef1c78f0c0dab9669df9f3aa67a4b0acbb6be8f0ebb5abef40f01ac296d7d49712f0cc85d8be7c9a843b20121e2ee4b399511c8d015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
ffbee806e5190f3ccdce5fc76fcb37b7

SHA1
60b21f8c6d11d0594cec97ea385f1c75f4917be7

SHA256
f1d95d86dc6a51fd13985346b644c53190db60e8c5dbaa588e013acef7ec1bb2

SHA512
8316aebe07f03aa6ae3d0ebf105f4496a4f6ac90c12e7f0e6245abf0b903adc394b180197a08bf4561d0f3b2bf0c79c9ca1c151093a9b1af6205ac64d8f51c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
ce9f9471dd921c87348a2c514523c595

SHA1
7c0fd19d9de50e4a256ed9746037d88021aad920

SHA256
69ab9f05697a2b6c4653bc282de63fdb6b631c31dce6f762309ff174fa90f9d2

SHA512
555ff1eb3ad51a0277aac95a85178c9783ba7d51c2f7d5d80dbdcdfbb5158b16d17a00ecbec7998870f22a0003a646ba131e221449c15a509fc332353fb7a891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
31eeb10af698c8b70939d0eec45407d4

SHA1
a8c9acd89c0b8d9d1b88f379333d3556da74614b

SHA256
6b47f3bd7870d553b3f6a618b5edd7be609caef0f4afa2796f5522a9cd3914a0

SHA512
1886403ed6611844e79bbc0a98e4ad05556cc8880800a1770454beea69b4c9719f0f2fedb69ec33da3617066bcb358ccd8070ab3c5ab761a8d675848067b7145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a1ee217728fabc737bd021c5d0700c84

SHA1
e62e666afb277d70fe65ba40a88b55ea3f936774

SHA256
5b7edd288abdba7f09cdd7896ab6c7751fec748ddabb85313b1c3ec422038834

SHA512
a5b9c49e939f306adadea133b09995650527339f9f81f009e7a38499dea64c2b067a01977cf01e1b21c0cd36003ab8a0661e30c55d79e0ad58a4606249953ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
f3d33fe038e61a6d0a11f5a4f7cbeab7

SHA1
cb2d37012190d153b6a69b72e24667d4fd9d74ef

SHA256
3f5f7f4b0c6b8c5fecb8ab5e22a13c0f103a4fad9e560affb1b519c53b71fbe2

SHA512
e44362a51ac2bfdcae39c2c4b51f023dc8ba50ab840d773708f7d82ca4d2c429967acf2e00b77aa4b32977d25722def562d9da6de35bb990f61f3bbe1bd89ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_236E243F97CD352248042AF77144B4DB
MD5
d7975787abe7f8aeb277c528248de97c

SHA1
be8a484d0bd4bfb3d320ed0a904d6ab99a106668

SHA256
938039cc02dc03794e6b9da69467a30008a0cd1305430a0aa4aa3db33af8041d

SHA512
c2bac516fe82b58216113b7c436cd90552560d39544c757c58d32511a554ffcb5ac0ca7ecf91e809124f50e6db7da80e89255344ced68216c4837eb2fa0c587c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
24e1c3496375eee5933bf4a88a3bdae2

SHA1
a6be1e5731239843b3734b951a8994f3259340f0

SHA256
f75ce35ed1d4eea38ca16b7326f62642285fdcdb20581b8bb8c410b0882fd6cc

SHA512
49d50407f210b3cd969e8822bd6784a852e630c638f8e5d871bc4aedfef3c9fbd6a461576e8ab731a96a79f95cb2b94b41c3e7f9e609095d9dc1dddab5f52ec6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\A904LRUW.txt
MD5
b66166599f1510f3278290c6ebdeaec4

SHA1
75fb663ede09bc3d5bb5654192b1a2f08c8c8c42

SHA256
ee0f217485dfcc2a0d5b07b512f35aa23cfed0970ee68ed261f286fd0c0d5d58

SHA512
86b9f6d9bdafc7e3cce6f43b4c252e282f1610c96faf829fc28cdba9ec644ceb15cdb170e6bf3532ec996c59a9c296e3cb296d3148a99fd19ee98bc8823f55c5

Download Submit
\??\pipe\crashpad_1900_JWDWNVCPISEVRBFZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/716-65-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/716-56-0x0000000000000000-mapping.dmp

Download
memory/960-57-0x0000000000000000-mapping.dmp

Download
memory/1088-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Filesize
8KB

Download
memory/2992-74-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Filesize
8KB

Download