Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2023 02:05
General
-
Target
f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe
-
Size
1.4MB
-
MD5
08a78797a1a4f7b222b9e51d26459e00
-
SHA1
333267d9f70e1c7ce3b2c484f17666ba8e246a0a
-
SHA256
f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d
-
SHA512
dfc65032f1e8d0d4eadab1ef11e9271115559a2f507429a1030850c1599c1f836e1132d4ab166182d5c5981ccec0ae0980dce5e1173376951ebd2404937019c6
-
SSDEEP
24576:AVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEP15httlW:MpJOl8xFMRy/SeQgt537W
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 10 IoCs
Processes:
f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exedescription ioc Process File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File opened for modification C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 2968 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133225455280800500" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid Process 4124 chrome.exe 4124 chrome.exe 1868 chrome.exe 1868 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid Process 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exetaskkill.exechrome.exedescription pid Process Token: SeCreateTokenPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeAssignPrimaryTokenPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeLockMemoryPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeIncreaseQuotaPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeMachineAccountPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeTcbPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeSecurityPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeTakeOwnershipPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeLoadDriverPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeSystemProfilePrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeSystemtimePrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeProfSingleProcessPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeIncBasePriorityPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeCreatePagefilePrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeCreatePermanentPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeBackupPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeRestorePrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeShutdownPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeDebugPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeAuditPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeSystemEnvironmentPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeChangeNotifyPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeRemoteShutdownPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeUndockPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeSyncAgentPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeEnableDelegationPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeManageVolumePrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeImpersonatePrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeCreateGlobalPrivilege 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: 31 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: 32 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: 33 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: 34 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: 35 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe Token: SeDebugPrivilege 2968 taskkill.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe Token: SeCreatePagefilePrivilege 4124 chrome.exe Token: SeShutdownPrivilege 4124 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid Process 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid Process 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe 4124 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.execmd.exechrome.exedescription pid Process procid_target PID 2868 wrote to memory of 2744 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe 86 PID 2868 wrote to memory of 2744 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe 86 PID 2868 wrote to memory of 2744 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe 86 PID 2744 wrote to memory of 2968 2744 cmd.exe 88 PID 2744 wrote to memory of 2968 2744 cmd.exe 88 PID 2744 wrote to memory of 2968 2744 cmd.exe 88 PID 2868 wrote to memory of 4124 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe 89 PID 2868 wrote to memory of 4124 2868 f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe 89 PID 4124 wrote to memory of 100 4124 chrome.exe 90 PID 4124 wrote to memory of 100 4124 chrome.exe 90 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 1896 4124 chrome.exe 91 PID 4124 wrote to memory of 4884 4124 chrome.exe 92 PID 4124 wrote to memory of 4884 4124 chrome.exe 92 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93 PID 4124 wrote to memory of 4952 4124 chrome.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe"C:\Users\Admin\AppData\Local\Temp\f5863d1444e77167ab04e3973adfbcef168e33ed5712270a9c21497524e9942d.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd8479758,0x7ffcd8479768,0x7ffcd84797783⤵PID:100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:23⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3184 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:13⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3228 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:13⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3920 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:13⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5012 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:13⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:83⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4136 --field-trial-handle=1828,i,1053109531711049181,8467447255397158334,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786B
MD59ffe618d587a0685d80e9f8bb7d89d39
SHA18e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
SHA512a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
-
Filesize
6KB
MD5362695f3dd9c02c83039898198484188
SHA185dcacc66a106feca7a94a42fc43e08c806a0322
SHA25640cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
SHA512a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
-
Filesize
13KB
MD54ff108e4584780dce15d610c142c3e62
SHA177e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
SHA512d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
-
Filesize
20KB
MD5ee838687578a56a816138d2abbb8d735
SHA162cc5598d7b26942baa239d11c34dc1bb5e295a0
SHA2562797ce9a365a655daf6648b0bd938b674c9a072dace56418958f9d09775de1c9
SHA512b8e5e81c783712c33c323032d3f06188ae66a116bb0217f174d0d06f77918786b6e0d0503a3a1187a6461109de5e957e1d8a3bde41d61990e5d42febabca85cc
-
Filesize
3KB
MD5c31f14d9b1b840e4b9c851cbe843fc8f
SHA1205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA25603601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
SHA5122c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
-
Filesize
84KB
MD5a09e13ee94d51c524b7e2a728c7d4039
SHA10dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
-
Filesize
604B
MD523231681d1c6f85fa32e725d6d63b19b
SHA1f69315530b49ac743b0e012652a3a5efaed94f17
SHA25603164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
SHA51236860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
-
Filesize
268B
MD50f26002ee3b4b4440e5949a969ea7503
SHA131fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
SHA5124290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
-
Filesize
1KB
MD505bfb082915ee2b59a7f32fa3cc79432
SHA1c1acd799ae271bcdde50f30082d25af31c1208c3
SHA25604392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
SHA5126feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
-
Filesize
2KB
MD5f88a8b9235a9b5a120626a591abaf02d
SHA11e67c222c73f5cd5547a032c1c80b1af031504f3
SHA256a1baac7d534e47e5a453d5826561b0bd67f14af02d23804ae0699c2144cbb782
SHA512987c0f4a0de038b3eb0599c234985b0eba08e014ff46e9df6865bb41fa40e3a38c786d91d15cf451a8bbf4759433ca7493eb02b47e4aed918d2ab138fd143c94
-
Filesize
874B
MD51a1ce12da9f972c3284b895c321c7591
SHA1206c5cd21244cfa34ce191cce5dacd816e4de484
SHA256f866936aef1e285d1fda5134792361c1c3218e800ec0cf5ac0b0d2d35a57dff0
SHA51209f5df76a0a387e2dd6a0c7fa1a7caf68aa03983af93a4ad73e6bbc0026b92485f7256b2ca342f1e1ad1b188b8553a5a1bac06a194680ff15f657e6cb8c9d4ee
-
Filesize
874B
MD5a201de7e617af474ce0ab18923be2868
SHA1c50024d18cde6f4b6a9fa4d13f919d0c4f509031
SHA2562035454025f334340c862a250b67854a36563e6bbe0e68b7b17daf8db4cc6d70
SHA512fd5fcea669d372c522793f2751fd73363bd3f9a6ec39503bf20e4e87df0f4b7f0fa6c5d7e1a3d4251f2ccdd61766156d5570d37cf7ad7976398f1b94c80acfea
-
Filesize
874B
MD51202b3706f5ba67b288b4e20bcce38d6
SHA1bca061642bc68c917b96176c378728fdcb73ac56
SHA25641708cd630bd8f250649afae09e751cb45c3eb029bf4ec1589e23aab56348fe5
SHA512ce55e763519bf77217f6a089664ad766229c7559cb6cca895f4ebc5de44aa180632097e09550ad50d1e78d3c14beabf40499342176eb1eb3ea8f9bc6720a65ec
-
Filesize
874B
MD5b3cec80d520fd7ebcec3686387dcd3c8
SHA1b2dad1db40daef5f07e324eac7c82ae1cfa8c1d2
SHA256e189cb4d0fbb7c4fdf0a6f9762338ca96cdd088e3ada66711f37252b88c24a1c
SHA5125998bb3e1f2e43117275b8cde376e57b495c594ab2e4e357b240fe028b3ac787266950f3f2d85e9ef21195dd341621e210216787550995c939bd7220de84cf5d
-
Filesize
6KB
MD5bfe18ec003b38594174899b4f193a721
SHA19050947780cf7a5c30284001aed2b525191b36de
SHA256807feac2c58a9e35be847dd73bdb9385f3e760c842721651e61f8991bf8dfbf4
SHA512eb943f5c3d53a04558d29dfb7cab3c1c9b3c3cfbd260ee0efdfaa5315620095099e75a5c412705a9db00fc5de36ba51d89b6d791aa5730ef1ee7e1b026715654
-
Filesize
6KB
MD51f563213d72b6255067dcc5ea1b645f3
SHA179ebae212e88c7011e0cc969a02c9414c246929f
SHA2563d9ff91405c704bfb8df1c18f410209e9a4eb56d8fc1a4aa978e9a768714592a
SHA512a43ce525c84eaa399403c82657afbd92cc2be3a8682e9646c7cc8affe7353824ee381951056fa7398a7c65b4ac0e50d4835eedb2a0d4244dc120bd4ea0be63c3
-
Filesize
16KB
MD5973e33d24ebbe8b07ab002a2daf45f85
SHA1e763b14aba9e85db3be16d8e3b141c6a0ced99c9
SHA25610e1df46fbc34b42ec83784b6f1acad7a1acaa8c4701b92190b6b8f31de98e51
SHA5128423fc5e8519a5057ce6aa4d61416e801d9ffccb552ce654dec99eef04981e843da0cc6106646ae8c70b09b2c4b6dfd1fa345173f71ffe7d9835e2cc05e42207
-
Filesize
16KB
MD5be2991e3f6d74919f1bb62d673b8684e
SHA1a15e9283635b61745ce3dbc4e9d2e95c63a64e37
SHA256fef7cc75a20d87a24ba1784ffdb6f7e768f14cd8bf9ce1216e63f2693e4efb2d
SHA51288c100aab1029d4e2d55f97a5b1084d89e0ddcec75839613013a899935667d22f35dcd8cff776212d0685f2ba19b44f297ff95737fcab019f5c431a4c8f4dd36
-
Filesize
142KB
MD57c6279f6f79094764f55af8bdb41bc1b
SHA185e475fe37b03833935c7475d77e378a0522252a
SHA256dc2bce9846360e1d5647489adcf208530062c7d50d007ce914fa9f28737d16ac
SHA5128ea69b17759e345a4d96bc34dd5234101d14ee73622b32dc75f54f270cd3845e67910b7def15a2602a93b64bfc5e2c865953a2e6291946542beb4add76550b0c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e