Resubmissions
08-04-2022 18:33
220408-w7msjagae5 3Analysis
-
max time kernel
4294209s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
08-04-2022 18:33
Behavioral task
behavioral1
Sample
l52e69n6jf7..pdf
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
l52e69n6jf7..pdf
Resource
win10v2004-20220331-en
General
-
Target
l52e69n6jf7..pdf
-
Size
271KB
-
MD5
fbc8e930ac98ed622ccc845241c445f6
-
SHA1
0c67d3d229ff469ade126ae0bae4fc67566cdeea
-
SHA256
cd746e75a75831d28f31f7eb91d5ecfad7da8349873586e435974fc0bc9337cb
-
SHA512
22f42bd4b328577352e9dd721510e8bdbd199ad16c0c7301749ec694e86bc0a1aae2829d0c116881cc22863cf43b010ecbd4d284e47ba281133d7c1f120c7e0c
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc0000000002000000000010660000000100002000000032223a9c537fbee1e0c71229fe5ec83cd189b041cbc8007b4d1c4b737c383871000000000e8000000002000020000000ae04b71f62a41f25e37ee94d3d298a91a23374f4ea1e800f1499c9ac3207637a900000003d1e41e038f38f6d027eb0bbdef47802071758ca8c8893ff532ebe75ef37479f226b020827a33d564cc1971e56b2957ef0fa6be21e3fdf5c4786a306c36e448a485fab7e95453a7f872788ba1e2a54ba23d58ad1a88a750103a1c27e8c9542a87b736f40df2658b992f0543b4e9c9aeff61a519bfb11dcddc9799e58649e726d8582df070f8cc40c8ef25d749de8b09540000000caa8fd2478031b15c596dbaf78e264974140b6c93b0da8cff8810074ce33d43d15c90a0bca90cd5048bec6c358c9824cc935b60cbf616bd5c2c0c3d74debcc22 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A47E071-B76A-11EC-B5F4-760A3B1A01A1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40acd73f774bd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc0000000002000000000010660000000100002000000051e1dcf19421716122c7d32ee2199789950d25164edecd0c5385e3c3a22e9190000000000e8000000002000020000000a9ce0233f50494c7fc7006f9602353fd7fab488c68cc7ae28e1548911d6ec8cd20000000bc0e7b0d5c4d566ce37fa6e251550fb40aca201da035ae56113188390bed74dc4000000011f0f7db7ff0da2f763fd541c76af1d636127e7f5d34d08c5c29d1376a3eb2c91e2342f904928210014235458766ef0fa14813d1a54e5958ae01e6767cfdd39c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356207825" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 948 chrome.exe 836 chrome.exe 836 chrome.exe 2884 chrome.exe 2620 chrome.exe 2396 chrome.exe 2708 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1792 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
iexplore.exechrome.exepid process 316 iexplore.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe 836 chrome.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 1792 AcroRd32.exe 1792 AcroRd32.exe 1792 AcroRd32.exe 1792 AcroRd32.exe 316 iexplore.exe 316 iexplore.exe 820 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE 316 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeiexplore.exechrome.exedescription pid process target process PID 1792 wrote to memory of 316 1792 AcroRd32.exe iexplore.exe PID 1792 wrote to memory of 316 1792 AcroRd32.exe iexplore.exe PID 1792 wrote to memory of 316 1792 AcroRd32.exe iexplore.exe PID 1792 wrote to memory of 316 1792 AcroRd32.exe iexplore.exe PID 316 wrote to memory of 820 316 iexplore.exe IEXPLORE.EXE PID 316 wrote to memory of 820 316 iexplore.exe IEXPLORE.EXE PID 316 wrote to memory of 820 316 iexplore.exe IEXPLORE.EXE PID 316 wrote to memory of 820 316 iexplore.exe IEXPLORE.EXE PID 836 wrote to memory of 1180 836 chrome.exe chrome.exe PID 836 wrote to memory of 1180 836 chrome.exe chrome.exe PID 836 wrote to memory of 1180 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 1740 836 chrome.exe chrome.exe PID 836 wrote to memory of 948 836 chrome.exe chrome.exe PID 836 wrote to memory of 948 836 chrome.exe chrome.exe PID 836 wrote to memory of 948 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe PID 836 wrote to memory of 1760 836 chrome.exe chrome.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\l52e69n6jf7..pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://bit.ly/3jeiE6t2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5924f50,0x7fef5924f60,0x7fef5924f702⤵PID:1180
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=832 /prefetch:22⤵PID:1740
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1708 /prefetch:82⤵PID:1760
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:12⤵PID:2068
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:12⤵PID:2076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:2128
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2988 /prefetch:22⤵PID:2308
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:12⤵PID:2360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:82⤵PID:2432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:82⤵PID:2440
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:12⤵PID:2520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3944 /prefetch:82⤵PID:2528
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:12⤵PID:2648
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:82⤵PID:2712
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:2748
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:12⤵PID:2812
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 /prefetch:82⤵PID:2920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:82⤵PID:2928
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:82⤵PID:2972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:82⤵PID:3008
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:82⤵PID:2112
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4168 /prefetch:82⤵PID:2284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:12⤵PID:2488
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:2552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:2216
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=108 /prefetch:82⤵PID:2688
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,16458948266670245604,16120312483089438624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD554e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22F6FCCA1B505DD42D3A58F5E49C5567Filesize
503B
MD5aea5452d79529f112141c4e832ee010b
SHA1dc44df607eb310c02e076dca857f16cfb00798ec
SHA2568ebad3a746de3e68bdb0a2ad162e827c7acfb2ff8de144072343b3e8c85e97cd
SHA512f2ef68c9f91d1aa040711d345a654c7178b1de1ba20f7202c50087a61ca8a1077380ea00a31551162de502d5e965c2f188442bdd58304bc0134bdf93a47a3ff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5e86541c7b9490036f70724babf5dbe09
SHA1e532c23656604c6c4e47886115ea7ac539352087
SHA256520a17781c5f127c385e3025217c632f16f39756cee5723b3ee8372a3f2121ec
SHA5128c6825160d5f19a7e1d18975311dc09e719e6284a1caa445e513afde98c18d3e50e37571e47a911c70c23d594ef444950492c7acee47e8b5e8b177679c6e566f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD55a11c6099b9e5808dfb08c5c9570c92f
SHA1e5dc219641146d1839557973f348037fa589fd18
SHA25691291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172
SHA512c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5c8b0340152254d45129d49fe4a79bb6c
SHA1938c5d35390eacae589916d99078394b87a8e2b1
SHA2569b0b0300dc78888a02f1aab372b93946e1bbffbcb53b9e3c5dc5877e3d8e026b
SHA51230da88c04ad36e0047ba3b72a3c84e842de0e4e02acd5825549bc4f1f3c694cf0d8201ce1c8330f5d681df7d678d54e5f23daccd0d4d6cc3effc1c161f346126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22F6FCCA1B505DD42D3A58F5E49C5567Filesize
552B
MD5e182922583e6ceed8c529460f5acea70
SHA1b01136f2be2ad07b4cd73075781e75bbd629f8b8
SHA256503fa6d0aecdaf5aaf6bda971a3b5ad01d1eac5ef52cd77b90d1cf07ee16b83e
SHA51240b3f927f2d70450c7d9ef3353e3e84d948d621207880dfb6e3a8b35b232b1b45870cb66bc7e6116346f1ac0103fd6e1266ebc4c7e276c5a21d6312da61c4bcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD56f9f89389094fc20a07f674e3fda52c6
SHA19608999d92bbb0eb8e32ec0131f33cbc30184bae
SHA256dbca7d9d71627ad1d25cf78589d91309ef8d8590ab224765dc3c2b3e1f73460f
SHA512d14c461dc0bc60156de09314d0bbd3e16ea5e9e9d15888253725be2c9caae062c3391c4a7819fd7c5ecfe24cf392ea46f85cb083a85d2ddd4fae4e5a3d643c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c780f65a151fcdda299fee3c1e5c2137
SHA1d14f71111638551eba8496daa49516ab2da93a7d
SHA256f67e6a364dfb5400f733d8dcd02892c5f6cc09621770e403ed1c16fefdc74dbe
SHA512993e81df4025ed02c07277af539ca2d87545536f995f78f620eb57daab1acbbf57ec852a6c827a63a6c3950ad3212ea3e1130275c114a7e56badddf1c0020d46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5613a3ff95a60e212aad9618e00872fa4
SHA1fd181445cb07885380e6bb8c22c74dd017513d8e
SHA256215b0ad3b618a9efa51ed89f47f4c6f76ee89f08ad6677e44581eb75f02fff3a
SHA51234afa6b6f863666fb9c112584c71ea82901306dc6c58f0773439eae9319c53c13f713fda015c5809a4fd4c7b5b1ae32432b44d8ea5c2678f66b8a68d645bc423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ad5f52fab60cd5b44b271eafa63e82a6
SHA142133e4342504de7771abd48245c2c23797bc5ed
SHA256c671a514fcc7f6a34134b4b715c3638a0d138f36c9cbb2b747f50b89ee98993c
SHA51275c420ad50daf82f18082635bb2dceb890d641bbbbd49d24ca4633e725ef2f9e74b936ef6101eb1463729b01e1720022ee00afabed092c49430329db6bdcbb77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53494d0f3c0e70dd99feb4fff3c63dc8a
SHA17ccc7cc52de2fabe5e16adb3bac3adc8b76d1c8a
SHA2565fe4c0b5aa67a0effb4971386ffb9970a7bc58879a6f46c0d58fb5ef3b0e3d4e
SHA512e97e18bd0dcf041a4da819d047d92b923d819ab0f1a6910332838e6ae1e1a1d9102450844a6112161910558c1ce5722fb2f5cf6e4fc4e24333094e5246c90ac8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dd097b7d716bdabc3352a71a3171a96f
SHA108f6269d0bd4c2a53f90e69ae4d66ce2901273ae
SHA256155b9649186ebc0514c5fe776d35241e6a28a8fd7bcfe3d6e850a2e9af06c055
SHA512343ee3c6dfd0c97708b0bed56a777070b68627ac96aa6b2cd251735b6e337ebfd4a3654d28a516817a8c9d7042e9a817a01595ddd37b8d56c49c5d4ad43271c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5aab1b5dfbb49589d0efb70d995f6028f
SHA1075dde1a08c728618ba02f8338a18c46349539cc
SHA256792889b72fa923a8ce910cdf743ccb38bdbf7683d273d7b10bbc788a91c390a5
SHA512ae96d8239e188e7e2482b9d377b40358d8ac26b5fb5a75b07e1bf4cca505d3137dc878ee733c066fa7d01ef67c8ff4ec459cb96de502401053e8de18481493bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD52dcd06ecdf6ca62e8443c3b1adfa0e7a
SHA104bff183a930ebf6aa57d74dcc87eec226e79b27
SHA256ce1fd540c7c6eb216e53d9c4f7d666e3aaa1ef373961e4ba7082a01cfb2ad089
SHA5126e6fefe4b593a84f7967bb2d5ebc12bde62be0c5d4cd46db43a39aba2270e4a8bf1cbb1aa150ab0c04329ad1351d83e73cf26f2c2c0122c4f1e3eff3f20f7e8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5d7857a47f01d4cb521904dad5ed95948
SHA1063b20c3aa91c873adc471811020c44c7d8972d4
SHA256fe2459cbe830609c21d5b5329acf8b426fd565405b91859f3caf1a45b0225654
SHA512e4994ed4ed7787dcfeeeae3dcf328da224030f468505e79e889d6f2e27394157ceec6f5dfeeddb4054cb8bdf72bf793b206630b095f48500d3f37571daf6040b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EAW5R1Z6.txtFilesize
600B
MD56c7ae10e149b111546232d8643ab66a0
SHA14a72a115b17ac1830373c8eb55a3649f328dc2c7
SHA256c37ab9bf169a0482eec6957871e5813aa99d4f260e12d3ebff86e4496c842b89
SHA51203b98b50dc5b7d62ea5455af72061e65cafa723fe7c8144dd3c3753bd46872e51819724d78648100f70246a70f03c1c3077d55c269aff33311f135140a4b1556
-
\??\pipe\crashpad_836_YRVEVMUYNNQSCUCKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1792-54-0x0000000075EB1000-0x0000000075EB3000-memory.dmpFilesize
8KB