Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
20-03-2023 03:39
General
-
Target
d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe
-
Size
1.4MB
-
MD5
3c8fe4c17702db8378648d00b8d93c4d
-
SHA1
2563da3b8b0192abdcdb4f580615314de377908f
-
SHA256
d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e
-
SHA512
34ee22da04079fb30531ac484f2b06174789ff177517f4f97763fb889851d71e7004ee13fcde6c2dd7cc54de7252614b446fdf9940aac74fb44b794e1c83fad4
-
SSDEEP
24576:kGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRLB5hQS4:PpEUIvU0N9jkpjweXt77F5+x
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 10 IoCs
Processes:
d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exedescription ioc process File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File opened for modification C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3128 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133237607978154660" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
chrome.exechrome.exepid process 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 4540 chrome.exe 4540 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exetaskkill.exechrome.exedescription pid process Token: SeCreateTokenPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeAssignPrimaryTokenPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeLockMemoryPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeIncreaseQuotaPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeMachineAccountPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeTcbPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeSecurityPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeTakeOwnershipPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeLoadDriverPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeSystemProfilePrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeSystemtimePrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeProfSingleProcessPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeIncBasePriorityPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeCreatePagefilePrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeCreatePermanentPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeBackupPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeRestorePrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeShutdownPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeDebugPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeAuditPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeSystemEnvironmentPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeChangeNotifyPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeRemoteShutdownPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeUndockPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeSyncAgentPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeEnableDelegationPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeManageVolumePrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeImpersonatePrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeCreateGlobalPrivilege 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: 31 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: 32 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: 33 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: 34 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: 35 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe Token: SeDebugPrivilege 3128 taskkill.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.execmd.exechrome.exedescription pid process target process PID 2148 wrote to memory of 4228 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe cmd.exe PID 2148 wrote to memory of 4228 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe cmd.exe PID 2148 wrote to memory of 4228 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe cmd.exe PID 4228 wrote to memory of 3128 4228 cmd.exe taskkill.exe PID 4228 wrote to memory of 3128 4228 cmd.exe taskkill.exe PID 4228 wrote to memory of 3128 4228 cmd.exe taskkill.exe PID 2148 wrote to memory of 1500 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe chrome.exe PID 2148 wrote to memory of 1500 2148 d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe chrome.exe PID 1500 wrote to memory of 1940 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 1940 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4952 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4116 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 4116 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe PID 1500 wrote to memory of 3680 1500 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe"C:\Users\Admin\AppData\Local\Temp\d175121e36c818ddf701b41c4489263d719f3ac824d8d0897cdcdb1dd0f3ed0e.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffeb3b09758,0x7ffeb3b09768,0x7ffeb3b097783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=480 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3048 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1636 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4844 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3804 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4596 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1848,i,9070800869387254825,10535887060883219419,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.htmlFilesize
786B
MD59ffe618d587a0685d80e9f8bb7d89d39
SHA18e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
SHA512a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.pngFilesize
6KB
MD5362695f3dd9c02c83039898198484188
SHA185dcacc66a106feca7a94a42fc43e08c806a0322
SHA25640cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
SHA512a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.jsFilesize
13KB
MD54ff108e4584780dce15d610c142c3e62
SHA177e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
SHA512d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.jsFilesize
20KB
MD53bd84d64c10d9146055f4f1307c0b5f5
SHA1f2748ea726b9e545632fc13251e26ab4625c1310
SHA25670e01d1de6e48b1e70e94f8d2751bfed7da6f011698afa3f4f7232be940faa1b
SHA5124187538e60d4acb4e70ee485b27695039c69f2aa3d85624544c8081d422a56b8db404b8393f31e766a50e25eb38120fa49b5e93a701c601210ad620b3515faff
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.jsFilesize
3KB
MD5c31f14d9b1b840e4b9c851cbe843fc8f
SHA1205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA25603601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
SHA5122c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.jsFilesize
84KB
MD5a09e13ee94d51c524b7e2a728c7d4039
SHA10dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.jsFilesize
604B
MD523231681d1c6f85fa32e725d6d63b19b
SHA1f69315530b49ac743b0e012652a3a5efaed94f17
SHA25603164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
SHA51236860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.jsFilesize
268B
MD50f26002ee3b4b4440e5949a969ea7503
SHA131fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
SHA5124290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.jsonFilesize
1KB
MD505bfb082915ee2b59a7f32fa3cc79432
SHA1c1acd799ae271bcdde50f30082d25af31c1208c3
SHA25604392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
SHA5126feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5393c36657267b816f535d7b6e6d73ed5
SHA16f1eda3b060de65012968854ebfdebb03ca14201
SHA256e15d9d4e325acb64cbae842b0fbc455c12482200dc41700b61f65f35f06fff63
SHA5128c44c70ca6d833b7ee6ead0113ee3d2fe2d525fd72406b5cb9ea32a391af90fdd3ad6224e23d5d4561549a91476560d59f68b63d527d815c6531ed57a594f64d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
874B
MD59b4051d774d1cf6608440343da22a0f5
SHA1c53c88acfdb02db4238a9cfd738d6d9e2dd66124
SHA25617c0b509ebce927b14626b09206940b1166f20481a5a57ec5b154201a078aebd
SHA512545862259f487b774e2fca7ab3bf029d3f916d8e78661caad7a03230bab1ec21e93f38d83e84613d90e1f620bed3165e3e1d8f81581cea0be15b9a4e85db619d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
874B
MD570a46cc46d009455f0f0e57b32992f3d
SHA107bb68cdec163d59e5e9d96b84bf4c710be25a85
SHA25635a2cf671d2a0d7ed32e20bd609881b47864c319967dcd9bcf9e4e732f17a299
SHA512bc45b564d772f0c739ffcfedd3d1d01b65515438ff29b5b11f09b695e349c2cc2fd5470217eb7746956baf24eee516000522f7cf269e371c4322d1008d9e279c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
874B
MD528b1daf7fda676f9d17ab5bc7d04e1b0
SHA1c81db95452954af7121681e8f469745f4a9e11c9
SHA2568e15c7a80f36bca59a911a4f2948f57464b6791abea3c6835b168072d5d32ea1
SHA512643d5f0cc317e07ddc2a2e4cfbb9e1262ae1097a9d17158d136ece386d7fbb09304124f5359f5ffb38162f41d1bae1ee46cbfb6ac2b0764a099e259d1ccafee6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
874B
MD5c77305bce07e976d3f295f062eea8e26
SHA1b52a3e967bc76913bbf783e79f8dd58e45bae8ce
SHA256df06e6820f4f80d7cbce5db8efc5a709c658b28f20c664d5f86fadc4c7930530
SHA51277e92baf6502e5784ec8354b2e855c4b0d4710c38cb087ed3dc3e5c004bf12105aff81806b6c262b571d43bd81a3a572579812fb471708b08371e63c685a9826
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5f6cbc6bf23b8fce15e8cf1d6da4fc4ed
SHA17546d00a9755093217d6215b758e7eb46e19288d
SHA2562efd7d96f98fb96f399fd334f082f7f0f11e9bec39ee15dcc000e877404fe984
SHA5125924e2b337aeff3d0a8c530980ffa8ae84da947da58272495bf0f40032a63b439eab6e8ffc8bd117da25f1ca23111dfc3a18f828c7e771a4db10dc50a0209005
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5ce8650b8332b3b0649334517317b90b5
SHA1101a6ddb10c695c6d9612e06ef19b7705b080a21
SHA2565975ad3df2258064f6c3089354b7dec076dc2ca250ba120fabd3ee6375a8077c
SHA512b5479bba495f17b74840246b9d89eb65226f9e9cdb87d6b57b2512c4a1e85c4c17c380d76d4ec2f69e8c48f274e6e30330d2c2ddf4d7c3abcce805b7d64831ec
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5ac267f78b1a2e0cdbd9e5d0690d89928
SHA149cb3e8d6b70a0c77ae40ebca1d6b4d0c726266c
SHA2567be5357db009dea8d1a35a5b6ccc16687e0b69fbe672d0cef8e9bb4000a1c654
SHA5126e4efbcf11e0522c1a6daf0b3bf7d01c390c0ddf1ca9c1b005d16a9bb9a52655a06e370cca578ba47bc2cc5f8b4bd42834bf1ce8f73638521d42d76709feb1d4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
11KB
MD5bec7d9643f4ef0dec8a7b41bc56adeb7
SHA126be25ac4da9577a0047ed73c85a786ab626f455
SHA256230b1ea085750045b3515b65362785c146abfae87d143d0af5221934af5944dc
SHA5129f8b66585879cc13494ac6c5db3ae3617be115014c892c68b3ee73d01b5dec5d05ed5ba008040a13c952708e66bc31a13c706c06e412549cea318354fd12e569
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\da6d0e18-89a3-48b5-9788-0ed295fb42cd.tmpFilesize
11KB
MD54a3cb919074369f6d36ac37ee949ca56
SHA18daeeb12dee88e43d86ee2faa88c8df8725daf06
SHA25668634f9473472938c65068fcd5f840124939bca46ec75c06b5fdf94bec0afca1
SHA512969795da1392fb77b7e367c78356d438e9db7d72c10a450e27e3729ad1eb9f74e04805d65a0d3cd8f7f2383b17fff063bc3323e7cabed6f8e1a812be56ffb081
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
146KB
MD51a19393f5e6c0bb00039cb67c501979a
SHA1fbd8abf7e204645a052fc60330cf568e9143f7b0
SHA25677db23ca834452bf84a0b3008d22786a53865dee37a76670411d26b720b0b393
SHA5125d1a69120859852613c200a4d3951cdd2d196e926dcc643ca0610f34852106007567ba94f30414fb270d0660a0dae03db7c5e115dfd5fc8fe8e7572a43cd2d93
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
72KB
MD59c97a8416f2347ee70166dada0c441f7
SHA126e594a49ab29cfef42f8f28d559c80c8dedce2b
SHA256efbd58e59c2abb2750f9842f41ccebf037c312ddc3e0012ba915e6860be66535
SHA5120f37eb305951c898d3543eaa323cfa92b3b727f916424eba7a6423110943d8879d3a85abcdd80528a930635f8f730c40982f1fec161971202f76ebd2ca1f0768
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
145KB
MD52a5a1b2ac4982782a2f72d6f4a6b494b
SHA19b194f709ee6e4f6ad8ebf141c6f32891f70807d
SHA2566db5df1280712adf397a8e92b3bfb82875deb3fef1db3dff4767947750b60b0c
SHA512b5dfb7571a56840bd66ebf0cd71e7270af7f43f875549189cee69718bacbb58228f303fd32bcba918456856bf68a5c7a66233e1e832dfb8847b0ca8286193096
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
145KB
MD52dc4756c622a58d29317f40758d17b0b
SHA19e79b59d3808cf4422b85f032ef5eb2bc6b88690
SHA256fa98d677e079edbcf46d1fd6611113af9cf754435dd6abd549a3b4e33bc5f5bc
SHA5125a567ba4b29540e98a45147e6cacea0cb53914d4956d5563580d4fcbad9c7754e1f10d505aa3dfd5950822fd7af8646f2467f8ebb6a87fe4a328f4fe9385811a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1500_KPZHIDELFFNDFAZRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e