d4814a895aa5e8cc7ef2751eb7b378995ec929a441056c25e54ae87522f8ac20

Analysis

max time kernel
103s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

browser.exe
Size

89KB
MD5

6bea7d0314e1e86f1e284f4be64ee0d3
SHA1

e20bde0a5a8bce416128133681532191e3258efb
SHA256

d4814a895aa5e8cc7ef2751eb7b378995ec929a441056c25e54ae87522f8ac20
SHA512

a1f42d06c0b1a46892565e83229d946f106fe5353f4172efb6751416bdf2c861470d72d35e90773a4a44ba7805fe159e91bf019a3d8fd167b80e90cc814c9a1c
SSDEEP

1536:D7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfcwgnOl:f7DhdC6kzWypvaQ0FxyNTBfcLu

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exechrome.exechrome.exe

pid	process
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2308	chrome.exe
2308	chrome.exe
4840	chrome.exe
4840	chrome.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2576	taskmgr.exe
Token: SeSystemProfilePrivilege	2576	taskmgr.exe
Token: SeCreateGlobalPrivilege	2576	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe
2576	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

2104 firefox.exe

pid	process
2104	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

browser.execmd.exefirefox.exechrome.exemsedge.exechrome.exemsedge.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4532 wrote to memory of 2776	4532	browser.exe	cmd.exe
PID 4532 wrote to memory of 2776	4532	browser.exe	cmd.exe
PID 2776 wrote to memory of 4048	2776	cmd.exe	chrome.exe
PID 2776 wrote to memory of 4048	2776	cmd.exe	chrome.exe
PID 2776 wrote to memory of 224	2776	cmd.exe	firefox.exe
PID 2776 wrote to memory of 224	2776	cmd.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 224 wrote to memory of 2104	224	firefox.exe	firefox.exe
PID 2776 wrote to memory of 3116	2776	cmd.exe	msedge.exe
PID 2776 wrote to memory of 3116	2776	cmd.exe	msedge.exe
PID 4048 wrote to memory of 4152	4048	chrome.exe	chrome.exe
PID 4048 wrote to memory of 4152	4048	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1000	3116	msedge.exe	msedge.exe
PID 3116 wrote to memory of 1000	3116	msedge.exe	msedge.exe
PID 2776 wrote to memory of 1316	2776	cmd.exe	cmd.exe
PID 2776 wrote to memory of 1316	2776	cmd.exe	cmd.exe
PID 2776 wrote to memory of 4624	2776	cmd.exe	chrome.exe
PID 2776 wrote to memory of 4624	2776	cmd.exe	chrome.exe
PID 2776 wrote to memory of 2952	2776	cmd.exe	firefox.exe
PID 2776 wrote to memory of 2952	2776	cmd.exe	firefox.exe
PID 2776 wrote to memory of 764	2776	cmd.exe	msedge.exe
PID 2776 wrote to memory of 764	2776	cmd.exe	msedge.exe
PID 4624 wrote to memory of 3632	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 3632	4624	chrome.exe	chrome.exe
PID 764 wrote to memory of 3984	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 3984	764	msedge.exe	msedge.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2952 wrote to memory of 736	2952	firefox.exe	firefox.exe
PID 2104 wrote to memory of 1492	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 1492	2104	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4048 wrote to memory of 944	4048	chrome.exe	chrome.exe
PID 4048 wrote to memory of 944	4048	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe
PID 4624 wrote to memory of 4464	4624	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\browser.exe
"C:\Users\Admin\AppData\Local\Temp\browser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BFCA.tmp\BFCB.tmp\BFCC.bat C:\Users\Admin\AppData\Local\Temp\browser.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "pornhub.com/gay?search=femboy"
3⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab9b64f50,0x7ffab9b64f60,0x7ffab9b64f70
4⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,5312015722160458453,15336116208694002797,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
4⤵
PID:944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,5312015722160458453,15336116208694002797,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,5312015722160458453,15336116208694002797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:8
4⤵
PID:2320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window "pornhub.com/gay?search=femboy"
3⤵
- Suspicious use of WriteProcessMemory
PID:224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window pornhub.com/gay?search=femboy
4⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.0.761477069\752944317" -parentBuildID 20200403170909 -prefsHandle 1736 -prefMapHandle 1728 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 1796 gpu
5⤵
PID:1492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.3.555279196\1795066401" -childID 1 -isForBrowser -prefsHandle 2596 -prefMapHandle 2472 -prefsLen 78 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2580 tab
5⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "pornhub.com/gay?search=femboy"
3⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffac9c746f8,0x7ffac9c74708,0x7ffac9c74718
4⤵
PID:1000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11002449593453583921,12142642025582286217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
4⤵
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11002449593453583921,12142642025582286217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
4⤵
PID:5404

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:1316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "pornhub.com/gay?search=femboy"
3⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab9b64f50,0x7ffab9b64f60,0x7ffab9b64f70
4⤵
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,17049087685794759729,12357464242839023326,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
4⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,17049087685794759729,12357464242839023326,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1940 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,17049087685794759729,12357464242839023326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:8
4⤵
PID:5800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window "pornhub.com/gay?search=femboy"
3⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window pornhub.com/gay?search=femboy
4⤵
- Checks processor information in registry
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "pornhub.com/gay?search=femboy"
3⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffac9c746f8,0x7ffac9c74708,0x7ffac9c74718
4⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4648582800837183280,8208860581508375882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
4⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4648582800837183280,8208860581508375882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
4⤵
PID:5508

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
709abe60edd890aec38f0de2343a5555

SHA1
d345fca81f82a2b38a1398aa8ec70ff8b25bede3

SHA256
1b2a19aecb8e0405a1a1b108a895473188621fb0733d2f1b924f95475d3d442c

SHA512
ed7a4800945492d73f44ec50353dd68625a4027433b8b4482c6e10110e0d2adb79bce1e74747d74305c32204385191b409c2c5d718e2d383b370e0f7e29dd200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
709abe60edd890aec38f0de2343a5555

SHA1
d345fca81f82a2b38a1398aa8ec70ff8b25bede3

SHA256
1b2a19aecb8e0405a1a1b108a895473188621fb0733d2f1b924f95475d3d442c

SHA512
ed7a4800945492d73f44ec50353dd68625a4027433b8b4482c6e10110e0d2adb79bce1e74747d74305c32204385191b409c2c5d718e2d383b370e0f7e29dd200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
709abe60edd890aec38f0de2343a5555

SHA1
d345fca81f82a2b38a1398aa8ec70ff8b25bede3

SHA256
1b2a19aecb8e0405a1a1b108a895473188621fb0733d2f1b924f95475d3d442c

SHA512
ed7a4800945492d73f44ec50353dd68625a4027433b8b4482c6e10110e0d2adb79bce1e74747d74305c32204385191b409c2c5d718e2d383b370e0f7e29dd200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Filesize
40KB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Filesize
345B

MD5
a0339eafebdffe8a46ce3359ec82dddb

SHA1
31a396410f36206f4530b67230d00c73e7dfe6dd

SHA256
67f7848c26c27943b42d004c2d114a762b74442f77c4e4935ec3d461c9c30aef

SHA512
a3bf54248e0d4ca16936a9c7254e565a6345e0e25380c43a28771be5fd9d27f0d73985681fa4b47e1e645d57caabce2bcb587f1c132eabcd88d91efaf65293ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Filesize
321B

MD5
5e122563e9db8ab726509d89b394f67b

SHA1
b0c4650bf160fc7b2b0ba77deb21373a118a4c55

SHA256
b03697a4f0f5fc93e103020bd49a2ce7a94a46ac6a69d56784673c522dbaaaaa

SHA512
3d7f0f0dc07525163ab9d503228724cdd295164248f74f2567cb5fc9497740bc696000ed8da54374564ee6b9d5d3c82b3e0e3dd87a92773dc6b8173ff7a7045c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Filesize
13B

MD5
b63048c4e7e52c52053d25da30d9c5ab

SHA1
679a44d402f5ec24605719e06459f5a707989187

SHA256
389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

SHA512
e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d492567d4611438b2f936ddcaa9544ef

SHA1
ae88af380bbeb5e05a0446163a5434d70710f853

SHA256
0cba2ccfcfff09f076de767bf8df52485a8ac4b29cd3d14d53b23fdad2da3645

SHA512
150794b8598594ac00f827996e62d84b9331f1e35386e908485181204e823e8e5802fa543b53aca4d3046d176eaf4ee1dcb4df211589ea2fedac46170f162f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d492567d4611438b2f936ddcaa9544ef

SHA1
ae88af380bbeb5e05a0446163a5434d70710f853

SHA256
0cba2ccfcfff09f076de767bf8df52485a8ac4b29cd3d14d53b23fdad2da3645

SHA512
150794b8598594ac00f827996e62d84b9331f1e35386e908485181204e823e8e5802fa543b53aca4d3046d176eaf4ee1dcb4df211589ea2fedac46170f162f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
18ad3a99cbd5ddc6b806e98374137f92

SHA1
03b6e4402a81fc0585430539a6d4a208b6ca9020

SHA256
b4f8afdb8ec7975ab4f4bff3a5c1fcab389dee2b9eb38b9603099d500457145f

SHA512
faabf3e957ee6516f8e66a1decfb2279e3923f63d0bc3f4f6aa5082b84feba57e48d0c631800b962567313b26d6cb92192a29eef6faf7b0be01894233b4929b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BFCA.tmp\BFCB.tmp\BFCC.bat
Filesize
286B

MD5
d2146f3845c3127a8f1d235e8df66493

SHA1
5f8132fae859671e4676f584561aab3acd751fc4

SHA256
d3ef7607cc2efbc6a51fe165e89560517cf8b9a72f3d50821263c317348a8d88

SHA512
619c00b4fabcc28a45af70f4b9557c745ebb8cfb4ea9e1a6f36a04701a5d84dddf452c77fd256bc13dd7ee5de1d9877b1d666afd0995a74dcd990d9ae21dfeec

Download Submit
\??\pipe\LOCAL\crashpad_3116_HFKEDHJBXKENLTIK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_764_PELFZOHOTTVPHNXH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4048_RENSGDIGNJGMVIRT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_4624_VYXQULDIABWGOYDW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/764-137-0x0000000000000000-mapping.dmp

Download
memory/1000-135-0x0000000000000000-mapping.dmp

Download
memory/1316-136-0x0000000000000000-mapping.dmp

Download
memory/2596-151-0x0000000000000000-mapping.dmp

Download
memory/2776-132-0x0000000000000000-mapping.dmp

Download
memory/3116-134-0x0000000000000000-mapping.dmp

Download
memory/3132-150-0x0000000000000000-mapping.dmp

Download
memory/3984-138-0x0000000000000000-mapping.dmp

Download
memory/5404-152-0x0000000000000000-mapping.dmp

Download
memory/5508-153-0x0000000000000000-mapping.dmp

Download