hxxp://www[.]google[.]com

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
30/03/2023, 10:35 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d00000000020000000000106600000001000020000000a0b952a1252afc4836159d0700887bdb03e70b93daa23111f0ed76990e8874b5000000000e8000000002000020000000990c916b343f6185206b0f2462f83e9eca26792eac3e294f755699823f6ba60a200000004c074da86b30d389e9d5cfcfe70eb55745f4eacf6e6acb61614079d9739de6e2400000003dec9494db30d28484f756c96e8cd61279a021cf4e0f1ea5eb1c65b6ff7dcdcf6a52ad016139318aa9504233fc3168551e5e7b8c1b8ed429c24f85c7470c16ed	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d00000000020000000000106600000001000020000000fd141c2ae6500794d426cf83cd7b4c76252361089ad952e5efcb4932ef487727000000000e8000000002000020000000ae8673aa06dcc5299abf3b16db8dedffe8e9f59867b573609c56e2358fea123220000000bea5ae628ef5ead11df4a041a6fd0c3210107e67211ca7b0e2d7e898c0621ba6400000004a2523d14908aec39ca67e8bdd10752f4bd28a0adeb0f832b4f7f6a235c9070ea63ccb1e14a00ca391e90ff30029089802561c0e831b9c73dfea3e2b6358b024	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E89590A-CEF7-11ED-B673-FACD29011252} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2068fe450463d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0eb13460463d901	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133246533790183708"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
4524	chrome.exe
4524	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5044	iexplore.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5044	iexplore.exe
5044	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2132	5044	iexplore.exe	66
PID 5044 wrote to memory of 2132	5044	iexplore.exe	66
PID 5044 wrote to memory of 2132	5044	iexplore.exe	66
PID 3412 wrote to memory of 4904	3412	chrome.exe	69
PID 3412 wrote to memory of 4904	3412	chrome.exe	69
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 5056	3412	chrome.exe	72
PID 3412 wrote to memory of 2672	3412	chrome.exe	71
PID 3412 wrote to memory of 2672	3412	chrome.exe	71
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73
PID 3412 wrote to memory of 5072	3412	chrome.exe	73

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5044 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdb1eb9758,0x7ffdb1eb9768,0x7ffdb1eb9778
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3564 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3664 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5096 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3708 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3208 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3000 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5020 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1184 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5132 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3320 --field-trial-handle=1764,i,8703238016126045073,15734707246432651881,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b0
1⤵
PID:716

Network

GET

http://www.google.com/

IEXPLORE.EXE

Remote address:

142.250.200.36:80

Request

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: https://www.google.com/?gws_rd=ssl
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-NQQbjc-cw-YG-LsHPXZwBg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Thu, 30 Mar 2023 10:36:05 GMT
Server: gws
Content-Length: 231
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2023-03-30-10; expires=Sat, 29-Apr-2023 10:36:05 GMT; path=/; domain=.google.com; Secure; SameSite=none
Set-Cookie: AEC=AUEFqZf-8zUafvG24ibae45JkzIKeMah9zASLMN6E_hLrGt24JfShXHNxw; expires=Tue, 26-Sep-2023 10:36:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
DNS

36.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.200.250.142.in-addr.arpa

IN PTR

Response

36.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f41e100net
DNS

3.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.169.217.172.in-addr.arpa

IN PTR

Response

3.169.217.172.in-addr.arpa

IN PTR

lhr25s26-in-f31e100net
DNS

ssl.gstatic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ssl.gstatic.com

IN A

Response

ssl.gstatic.com

IN A

172.217.16.227
GET

https://ssl.gstatic.com/gb/images/v1_ff29c1d8.png

IEXPLORE.EXE

Remote address:

172.217.16.227:443

Request

GET /gb/images/v1_ff29c1d8.png HTTP/2.0
host: ssl.gstatic.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.google.com/?gws_rd=ssl
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 56690
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Mar 2023 21:10:06 GMT
expires: Thu, 28 Mar 2024 21:10:06 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 09 Nov 2022 07:18:00 GMT
content-type: image/png
vary: Origin
age: 48362
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

clients1.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

clients1.google.com

IN A

Response

clients1.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

216.58.212.206
GET

https://clients1.google.com/generate_204

IEXPLORE.EXE

Remote address:

216.58.212.206:443

Request

GET /generate_204 HTTP/2.0
host: clients1.google.com
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
referer: https://www.google.com/?gws_rd=ssl
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: 1P_JAR=2023-03-30-10; AEC=AUEFqZf-8zUafvG24ibae45JkzIKeMah9zASLMN6E_hLrGt24JfShXHNxw; NID=511=JkrfVzUwDZ0d4exM0BohnoN8Mms7VFQnNiI2m02oXMobIeegIwbhh0YUzK2q5ZMXsFLjdLFql6efFd2GvMQmAQeyj89AL63h6XCxslq9hkLgQf5_HsI0aOZZBAOdb8p64VfCvn1gqtH8W_XndEEgX_L7J1UOXebA1zuZ_Tknei4

Response

HTTP/2.0 204

content-length: 0
cross-origin-resource-policy: cross-origin
date: Thu, 30 Mar 2023 10:36:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

apis.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

172.217.16.238
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0

IEXPLORE.EXE

Remote address:

172.217.16.238:443

Request

GET /_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0 HTTP/2.0
host: apis.google.com
accept: application/javascript, */*;q=0.8
referer: https://www.google.com/?gws_rd=ssl
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: 1P_JAR=2023-03-30-10; AEC=AUEFqZf-8zUafvG24ibae45JkzIKeMah9zASLMN6E_hLrGt24JfShXHNxw; NID=511=JkrfVzUwDZ0d4exM0BohnoN8Mms7VFQnNiI2m02oXMobIeegIwbhh0YUzK2q5ZMXsFLjdLFql6efFd2GvMQmAQeyj89AL63h6XCxslq9hkLgQf5_HsI0aOZZBAOdb8p64VfCvn1gqtH8W_XndEEgX_L7J1UOXebA1zuZ_Tknei4

Response

HTTP/2.0 200

accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 38398
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Mar 2023 08:25:47 GMT
expires: Fri, 29 Mar 2024 08:25:47 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 09 Mar 2023 15:42:16 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 7822
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

ogs.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ogs.google.com

IN A

Response

ogs.google.com

IN CNAME

www3.l.google.com

www3.l.google.com

IN A

142.250.180.14
GET

https://ogs.google.com/widget/callout?prid=19026804&pgid=19026797&puid=1f3f174719d852e4&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=1&hl=en

IEXPLORE.EXE

Remote address:

142.250.180.14:443

Request

GET /widget/callout?prid=19026804&pgid=19026797&puid=1f3f174719d852e4&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=1&hl=en HTTP/2.0
host: ogs.google.com
accept: text/html, application/xhtml+xml, image/jxr, */*
referer: https://www.google.com/?gws_rd=ssl
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
cookie: 1P_JAR=2023-03-30-10; AEC=AUEFqZf-8zUafvG24ibae45JkzIKeMah9zASLMN6E_hLrGt24JfShXHNxw; NID=511=JkrfVzUwDZ0d4exM0BohnoN8Mms7VFQnNiI2m02oXMobIeegIwbhh0YUzK2q5ZMXsFLjdLFql6efFd2GvMQmAQeyj89AL63h6XCxslq9hkLgQf5_HsI0aOZZBAOdb8p64VfCvn1gqtH8W_XndEEgX_L7J1UOXebA1zuZ_Tknei4

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
x-frame-options: ALLOW-FROM https://www.google.com
content-security-policy: frame-ancestors https://www.google.com
content-security-policy: require-trusted-types-for 'script';report-uri /_/OneGoogleWidgetUi/cspreport
content-security-policy: script-src 'nonce-MUoT2rf3bYfQWFOuKt2w_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/OneGoogleWidgetUi/cspreport;worker-src 'self'
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-ua-compatible: IE=edge
expires: Thu, 30 Mar 2023 10:36:09 GMT
date: Thu, 30 Mar 2023 10:36:09 GMT
cache-control: private, max-age=3600
strict-transport-security: max-age=31536000
cross-origin-opener-policy: same-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: same-site
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

227.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.16.217.172.in-addr.arpa

IN PTR

Response

227.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f31e100net

227.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f3�H
DNS

206.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.212.58.216.in-addr.arpa

IN PTR

Response

206.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f141e100net

206.212.58.216.in-addr.arpa

IN PTR

lhr25s27-in-f14�I

206.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f206�I
DNS

238.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.16.217.172.in-addr.arpa

IN PTR

Response

238.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f141e100net

238.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f14�I
DNS

227.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.179.250.142.in-addr.arpa

IN PTR

Response

227.179.250.142.in-addr.arpa

IN PTR

lhr25s31-in-f31e100net
DNS

14.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.180.250.142.in-addr.arpa

IN PTR

Response

14.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f141e100net
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.180.14
POST

https://play.google.com/log?format=json&hasfast=true&authuser=0

IEXPLORE.EXE

Remote address:

142.250.180.14:443

Request

POST /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
x-goog-authuser: 0
content-type: application/x-www-form-urlencoded;charset=utf-8
referer: https://ogs.google.com/
accept-language: en-US
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
content-length: 333
cache-control: no-cache
cookie: 1P_JAR=2023-03-30-10; AEC=AUEFqZf-8zUafvG24ibae45JkzIKeMah9zASLMN6E_hLrGt24JfShXHNxw; NID=511=JkrfVzUwDZ0d4exM0BohnoN8Mms7VFQnNiI2m02oXMobIeegIwbhh0YUzK2q5ZMXsFLjdLFql6efFd2GvMQmAQeyj89AL63h6XCxslq9hkLgQf5_HsI0aOZZBAOdb8p64VfCvn1gqtH8W_XndEEgX_L7J1UOXebA1zuZ_Tknei4; OGPC=19026797-1:
DNS

227.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.187.250.142.in-addr.arpa

IN PTR

Response

227.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f31e100net
DNS

250.255.255.239.in-addr.arpa

Remote address:

8.8.8.8:53

Request

250.255.255.239.in-addr.arpa

IN PTR

Response
DNS

apis.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

172.217.16.238
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0

chrome.exe

Remote address:

172.217.16.238:443

Request

GET /_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0 HTTP/2.0
host: apis.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

251.0.0.224.in-addr.arpa

Remote address:

8.8.8.8:53

Request

251.0.0.224.in-addr.arpa

IN PTR

Response
DNS

b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Remote address:

8.8.8.8:53

Request

b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

IN PTR

Response
DNS

200.232.18.117.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.232.18.117.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

86.8.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.8.109.52.in-addr.arpa

IN PTR
DNS

86.8.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.8.109.52.in-addr.arpa

IN PTR
DNS

86.8.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.8.109.52.in-addr.arpa

IN PTR
DNS

86.8.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.8.109.52.in-addr.arpa

IN PTR
DNS

86.8.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.8.109.52.in-addr.arpa

IN PTR
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

ssl.gstatic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ssl.gstatic.com

IN A

Response

ssl.gstatic.com

IN A

172.217.16.227
GET

https://ssl.gstatic.com/dictionary/static/sounds/20220808/triage--_us_2_rr.mp3

chrome.exe

Remote address:

172.217.16.227:443

Request

GET /dictionary/static/sounds/20220808/triage--_us_2_rr.mp3 HTTP/2.0
host: ssl.gstatic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
accept-encoding: identity;q=1, *;q=0
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
x-client-data: CNP5ygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: audio
referer: https://www.google.com/
accept-language: en-US,en;q=0.9
range: bytes=0-
DNS

content-autofill.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

content-autofill.googleapis.com

IN A

Response

content-autofill.googleapis.com

IN A

172.217.169.74

content-autofill.googleapis.com

IN A

142.250.179.234

content-autofill.googleapis.com

IN A

142.250.180.10

content-autofill.googleapis.com

IN A

142.250.187.202

content-autofill.googleapis.com

IN A

142.250.200.10

content-autofill.googleapis.com

IN A

142.250.200.42

content-autofill.googleapis.com

IN A

172.217.16.234

content-autofill.googleapis.com

IN A

142.250.187.234

content-autofill.googleapis.com

IN A

142.250.178.10

content-autofill.googleapis.com

IN A

216.58.212.202

content-autofill.googleapis.com

IN A

172.217.169.42
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlL1An4iaKj4hIFDUqFnlI=?alt=proto

chrome.exe

Remote address:

172.217.169.74:443

Request

GET /v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlL1An4iaKj4hIFDUqFnlI=?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: CNP5ygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.180.14
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

chrome.exe

Remote address:

142.250.180.14:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://www.google.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: same-site
sec-fetch-dest: empty
referer: https://www.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

74.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

74.169.217.172.in-addr.arpa

IN PTR

Response

74.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f101e100net
DNS

2.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.200.250.142.in-addr.arpa

IN PTR

Response

2.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f21e100net
DNS

encrypted-tbn0.gstatic.com

chrome.exe

Remote address:

8.8.8.8:53

Request

encrypted-tbn0.gstatic.com

IN A

Response

encrypted-tbn0.gstatic.com

IN A

142.250.187.206
GET

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQkxWs296OS3yg5rhcqX4f94L7rGY2CVV_RNAZKEarGrKuPIad9BqtE1Dkl&usqp=CAI&s

chrome.exe

Remote address:

142.250.187.206:443

Request

GET /images?q=tbn:ANd9GcQkxWs296OS3yg5rhcqX4f94L7rGY2CVV_RNAZKEarGrKuPIad9BqtE1Dkl&usqp=CAI&s HTTP/2.0
host: encrypted-tbn0.gstatic.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
x-client-data: CNP5ygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://www.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

206.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.187.250.142.in-addr.arpa

IN PTR

Response

206.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f141e100net
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.208.99
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

216.58.208.99:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 736
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

99.208.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

99.208.58.216.in-addr.arpa

IN PTR

Response

99.208.58.216.in-addr.arpa

IN PTR

ams17s08-in-f31e100net

99.208.58.216.in-addr.arpa

IN PTR

sof01s11-in-f99�G
DNS

99.208.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

99.208.58.216.in-addr.arpa

IN PTR

Response

99.208.58.216.in-addr.arpa

IN PTR

ams17s08-in-f31e100net

99.208.58.216.in-addr.arpa

IN PTR

sof01s11-in-f99�G

142.250.200.36:80

www.google.com

IEXPLORE.EXE

144 B
52 B
3
1
142.250.200.36:80

http://www.google.com/

http

IEXPLORE.EXE

491 B
1.2kB
5
3

HTTP Request

GET http://www.google.com/

HTTP Response

302
172.217.16.227:443

https://ssl.gstatic.com/gb/images/v1_ff29c1d8.png

tls, http2

IEXPLORE.EXE

3.4kB
65.3kB
60
54

HTTP Request

GET https://ssl.gstatic.com/gb/images/v1_ff29c1d8.png

HTTP Response

200
172.217.16.227:443

ssl.gstatic.com

tls, http2

IEXPLORE.EXE

1.0kB
5.1kB
14
10
216.58.212.206:443

https://clients1.google.com/generate_204

tls, http2

IEXPLORE.EXE

1.7kB
7.7kB
18
12

HTTP Request

GET https://clients1.google.com/generate_204

HTTP Response

204
216.58.212.206:443

clients1.google.com

tls, http2

IEXPLORE.EXE

1.1kB
7.5kB
15
11
172.217.16.238:443

apis.google.com

tls, http2

IEXPLORE.EXE

1.0kB
5.0kB
14
10
172.217.16.238:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0

tls, http2

IEXPLORE.EXE

3.1kB
46.2kB
46
41

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0

HTTP Response

200
142.250.180.14:443

ogs.google.com

tls, http2

IEXPLORE.EXE

1.1kB
7.5kB
15
11
142.250.180.14:443

https://ogs.google.com/widget/callout?prid=19026804&pgid=19026797&puid=1f3f174719d852e4&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=1&hl=en

tls, http2

IEXPLORE.EXE

2.2kB
21.3kB
28
24

HTTP Request

GET https://ogs.google.com/widget/callout?prid=19026804&pgid=19026797&puid=1f3f174719d852e4&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=1&hl=en

HTTP Response

200
142.250.180.14:443

https://play.google.com/log?format=json&hasfast=true&authuser=0

tls, http2

IEXPLORE.EXE

1.7kB
7.6kB
17
12

HTTP Request

POST https://play.google.com/log?format=json&hasfast=true&authuser=0
172.217.16.238:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0

tls, http2

chrome.exe

3.0kB
46.9kB
40
42

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.fpEXMBCWMKc.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9SQGHwxhl93I-W5KEIEdf87vGuqQ/cb=gapi.loaded_0
13.69.109.131:443

322 B
7
8.248.3.254:80

322 B
7
172.217.16.227:443

https://ssl.gstatic.com/dictionary/static/sounds/20220808/triage--_us_2_rr.mp3

tls, http2

chrome.exe

1.9kB
17.4kB
16
22

HTTP Request

GET https://ssl.gstatic.com/dictionary/static/sounds/20220808/triage--_us_2_rr.mp3
172.217.169.74:443

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlL1An4iaKj4hIFDUqFnlI=?alt=proto

tls, http2

chrome.exe

1.7kB
6.9kB
12
15

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSEAlL1An4iaKj4hIFDUqFnlI=?alt=proto
142.250.180.14:443

https://play.google.com/log?format=json&hasfast=true&authuser=0

tls, http2

chrome.exe

1.6kB
8.5kB
12
16

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0
142.250.187.206:443

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQkxWs296OS3yg5rhcqX4f94L7rGY2CVV_RNAZKEarGrKuPIad9BqtE1Dkl&usqp=CAI&s

tls, http2

chrome.exe

1.8kB
8.9kB
12
14

HTTP Request

GET https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQkxWs296OS3yg5rhcqX4f94L7rGY2CVV_RNAZKEarGrKuPIad9BqtE1Dkl&usqp=CAI&s
216.58.208.99:443

https://beacons.gcp.gvt2.com/domainreliability/upload

tls, http2

chrome.exe

2.4kB
7.0kB
14
14

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload

8.8.8.8:53

36.200.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

36.200.250.142.in-addr.arpa
8.8.8.8:53

3.169.217.172.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

3.169.217.172.in-addr.arpa
8.8.8.8:53

ssl.gstatic.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

ssl.gstatic.com

DNS Response

172.217.16.227
8.8.8.8:53

clients1.google.com

dns

IEXPLORE.EXE

65 B
105 B
1
1

DNS Request

clients1.google.com

DNS Response

216.58.212.206
8.8.8.8:53

apis.google.com

dns

chrome.exe

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

172.217.16.238
8.8.8.8:53

ogs.google.com

dns

IEXPLORE.EXE

60 B
97 B
1
1

DNS Request

ogs.google.com

DNS Response

142.250.180.14
8.8.8.8:53

227.16.217.172.in-addr.arpa

dns

73 B
140 B
1
1

DNS Request

227.16.217.172.in-addr.arpa
8.8.8.8:53

206.212.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

206.212.58.216.in-addr.arpa
8.8.8.8:53

238.16.217.172.in-addr.arpa

dns

73 B
142 B
1
1

DNS Request

238.16.217.172.in-addr.arpa
8.8.8.8:53

227.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

227.179.250.142.in-addr.arpa
8.8.8.8:53

14.180.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

14.180.250.142.in-addr.arpa
8.8.8.8:53

play.google.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.250.180.14
8.8.8.8:53

227.187.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

227.187.250.142.in-addr.arpa
8.8.8.8:53

250.255.255.239.in-addr.arpa

dns

74 B
131 B
1
1

DNS Request

250.255.255.239.in-addr.arpa
8.8.8.8:53

apis.google.com

dns

chrome.exe

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

172.217.16.238
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

251.0.0.224.in-addr.arpa

dns

70 B
127 B
1
1

DNS Request

251.0.0.224.in-addr.arpa
8.8.8.8:53

b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

dns

118 B
182 B
1
1

DNS Request

b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
8.8.8.8:53

200.232.18.117.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

200.232.18.117.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

86.8.109.52.in-addr.arpa

dns

350 B
5

DNS Request

86.8.109.52.in-addr.arpa

DNS Request

86.8.109.52.in-addr.arpa

DNS Request

86.8.109.52.in-addr.arpa

DNS Request

86.8.109.52.in-addr.arpa

DNS Request

86.8.109.52.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

ssl.gstatic.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

ssl.gstatic.com

DNS Response

172.217.16.227
172.217.16.238:443

apis.google.com

https

chrome.exe

4.7kB
47.9kB
25
41
8.8.8.8:53

content-autofill.googleapis.com

dns

chrome.exe

77 B
253 B
1
1

DNS Request

content-autofill.googleapis.com

DNS Response

172.217.169.74

142.250.179.234

142.250.180.10

142.250.187.202

142.250.200.10

142.250.200.42

172.217.16.234

142.250.187.234

142.250.178.10

216.58.212.202

172.217.169.42
8.8.8.8:53

play.google.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

142.250.180.14
142.250.180.14:443

play.google.com

https

chrome.exe

4.1kB
7.4kB
7
10
8.8.8.8:53

74.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

74.169.217.172.in-addr.arpa
8.8.8.8:53

2.200.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

2.200.250.142.in-addr.arpa
8.8.8.8:53

encrypted-tbn0.gstatic.com

dns

chrome.exe

72 B
88 B
1
1

DNS Request

encrypted-tbn0.gstatic.com

DNS Response

142.250.187.206
8.8.8.8:53

206.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

206.187.250.142.in-addr.arpa
142.250.187.206:443

encrypted-tbn0.gstatic.com

https

chrome.exe

4.0kB
11.5kB
13
17
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.208.99
8.8.8.8:53

99.208.58.216.in-addr.arpa

dns

144 B
280 B
2
2

DNS Request

99.208.58.216.in-addr.arpa

DNS Request

99.208.58.216.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
396a100f6a6564bb182428417578233b

SHA1
6c47b10114daaf925d2a9689cf0254b7bb0870d2

SHA256
19efd3611c4205be05cab0c2f8c0df3e48f5399e812c9745dce0276960bda4e0

SHA512
bd379de76b38a59ad2fefae5254bcff8b0a45d6b10cb7b3dafec61b0c14fca3003a7350a9a78cf7f950b7a3c77f5495ea960df09fc1ac137bf020c02e4091289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_069B74A87A6EC019E2D40494DD95A2E8

Filesize
471B

MD5
21966d424aed17f9af10f69f1cb82860

SHA1
87ffcdc8f4d76491bc4a5cb3a01a3923d1dff2be

SHA256
6c02a4b1eee1b1c86633ef6364e6036e3f56b1eaa64a04b770d7641f7e2a2466

SHA512
f4a25d19c504572436548c89258651d1e941bb484e0ee7ab4a284f07143cc94153decff10fcc33020ccbfbc76447c5abb0f0780d706a7451fab9b25f82a493ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_A1AB6B0BC69E39DFEE327488FAF86590

Filesize
472B

MD5
9f52e1a56e3580c1bf81562a9df645f8

SHA1
7c0b65f04f7c1ce3cc65f0ab3207d8d18ba5350b

SHA256
28f16d1df407bb8bf6b28d978c94a40ea1f151dbc9e4e73493c999d881c3dc25

SHA512
2aa2bf72efde3817cc4f4dda5dafd292afd645df02e99546e44333d0a8a55408aad382cf87c93af8eacf426e4cedce7b2870fc87125a58d92e1b77a8e830b77c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_49270A533033765D7851C9B9F31A3504

Filesize
471B

MD5
3cf9744bdbf7aa66029d8ce19a463ef0

SHA1
98fcb55e438ff0e6152f7dbe237f0768df4bb51b

SHA256
ab6535587f929db33ed855dca46222ed9390f1eba231107aa481f74fc72f7ef5

SHA512
cf28634c924b9a3e40f452aafea1dfbf6ebe4d3749970ec12e587558ef47f66ab6dbdc94cc2d352ab593b98a291a897bf0b5cd9706c4f34f9eb481d9fff2aa1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_A40DDA23AC660EBD6C048B34D97187FB

Filesize
471B

MD5
dc0cf0275c44e5495e8f323c00b9d588

SHA1
f7f19e521a439f85915f7582797a060629b879c6

SHA256
abc856a823e0d89a87f6a4d3b2a48f5dcb99cdd94ce5d3b8cb8d51e665a74c4e

SHA512
21edf6b1fada2c88abe5632c1c825d432291291fe158f082388935fdebef0a670185acf0745aabacf89699c6b048a274c642a70c188548f409aa2edf56a443d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b59f9fa60adb7ed91516194c1d36b722

SHA1
b8f87ef63428c4d51bd721511ed36b7788aaa838

SHA256
c0038e6806b00f2b38d7d99d62af78d6e93bef828d9a77451e3b53ae3ac94b2c

SHA512
ac4c9bb34d5727c82ce7d97a75d6778bc5cd9e0bce01670d156c4c93408f5bba776ec138a969c1eb08941c2ffa2271e4f8051c0a876a6839912b57c9ed4f0a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_069B74A87A6EC019E2D40494DD95A2E8

Filesize
410B

MD5
8897db7e6c0d239dc6ce78de0c36265c

SHA1
11911c3e6d19a58121c495465e9116dee57a14b5

SHA256
88cc254bae507c5a75056bb18441f96e1dc5f7f16c3be6710465a2ef7a5ab746

SHA512
d76cb187c442619b78ffb81f621ae7fdcc3cd6a5e0624eaa5434d73e6471938366a8bb87c42053c0f4c9abc223afe7db84af06c3f9e345085fb3ff779cbd8fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_A1AB6B0BC69E39DFEE327488FAF86590

Filesize
402B

MD5
2c24efe56bdced1ff7ee53369efb0ec4

SHA1
b8a8deaba255a93c2878abe16e4b3357dc338d58

SHA256
f9f70715d1f0b5eca043bd8ab9fe99b81dd769ca16913e9795a3c4a5b3b61dad

SHA512
585854155b12ad947282b3fdaabedaf3ce4a0e7aef5f7f0a8e7e5f4e42ba06d1fc0dae759eaf0b72e7a124af54ddba895d92e80fde2cac8d27de8bb2dbe85c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
87beea7eb9bb140a8b904969fe93f00c

SHA1
5980094cb7721ccdf097fed00af2e50845eb993f

SHA256
01840224bf2e04d9afce10cffa28e10204ee6068e509c7db17df0c51b762d7ee

SHA512
58463542292b4bcfbdf935a48818311aa2a4a6e3cf41428996bf5ff42215e081c73929a8e2d903f114e8226538473b69607ba19a870103a052417b96ffa9c8f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_49270A533033765D7851C9B9F31A3504

Filesize
406B

MD5
2f91ec1188ae69d9686591a444a407ba

SHA1
0105d8dc08a3b45d667e577ad4a4dd427eab96f7

SHA256
4bdc3fb22c65cd95262de5affe8f2ace21eb416a9158db41ad306931e89591ab

SHA512
dec29c191b8c597abf8c4d3d18d5a8f6d324fd31bc0bf0f071d0f0100416c4b4b037470883520a0c739f58e6b9a6d857d2d0150f869f5f5157e2060877d9b6a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_A40DDA23AC660EBD6C048B34D97187FB

Filesize
406B

MD5
ee7cacc7c7a5001fa7ca7b0b050cfc0f

SHA1
8068bd2cc5a8dbb3b93dc4a481963fb8e777f48f

SHA256
07bbf3fda1bd7dfd2a8572056e7621fac6498cb0ad1608f5a3dfe2bcd6ba83ec

SHA512
616bdf62959b2822dc7268606a3e743543199efbece5830595560d99e66a784963797022f7b771ad8f989e9631efb32719c16879b1359aecf96682256cbca24a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
77d51eaf342443621ac8ff4bf3826546

SHA1
7d85962a9724f5485e1a0ef178092edcf14a23a1

SHA256
0a91b7450d51e71f164bb81bc058ec03dad54a770b9941921b978682e02f4c01

SHA512
549d4f3dd2d4ec6e61d2dc3c16618598e5ab6281a15fbf3761a055b61b335cb0ba89c3343a9640d90d708c6da244126e7556098f5cb45612353f6898fb6a02a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1015B

MD5
43a92c8b1487ad2034984e671de94b1c

SHA1
b6c6384869d3c6a1265f40e280a66679dea6dab8

SHA256
b2c9c700d41f2bf4a98e46d7804d415ca9a1ce55fd7445ad8ccc75c2234c66c1

SHA512
4c5e81cc6f174fc125fc9cd9de1abdc4f3ea1a17181abc2f2773ab0667d04fdecfbdb4d84bfe26f2a6b757b14ce660bb0ef6bd3ca28cd5d638a637c3f7748abf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3d0b407d04f33ace6fd8717815b3269a

SHA1
aee361ae35f46c5f1e1411fdb370f8d6a3b0f49f

SHA256
ea53dbcd3e327832ceb5933308025bd34634abaa925b9b85ec3818522ed4750d

SHA512
72b5a0bc28b544b0e8fef2d90a4ca50837456baf4aff74c70ade69c77617a35b1c5897df1392f6ff9ccbcb26565629d0f57e5349998e473b0d29e84a766d20c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
77c0b9d5215cd19a20d33753033407d6

SHA1
a02d7e078fed5d5e8dda4a452cf23d0fe0bc7745

SHA256
7c23e5bbd86067f9642f5871e23c301a2247974256844f4844c8deb36af0885d

SHA512
b3fe387f2a8c378589f186997583ddf7f9e95a4e793ded2f96452fb4ad6adba6af6d929cb61b1e69ea87b20fcf5000080eb8ad803d8ee58cd39ac13ab5286771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
0e523e0b0b41ba430b1e867f9b410f2d

SHA1
8d655d7923f413c502136c762028d67ad2ca5c84

SHA256
085211e7c3c33618134c806bb8adfe9c9eabfe55b1865decf3d06a4800e9f028

SHA512
35c7fddd6ad37716ba00c9bb90eabfbe10b7010b079c5cf3542c84883078b0a8907eb09a90fff03ba99003190c6252c4ecf7b0d2ee53282b00f5e1f9cc8c92df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
b59d4391e7c310b2de6b91fa8267dd76

SHA1
28bfbf7d9a7b4800436fd82ccb8e6d1e8220b371

SHA256
e528ad40b39f442889a29fbada09cbb9ec84d3f7fbf106ea70978f1b15f03b74

SHA512
edecfc04f5007a378019c9178c02c34875c695bbbae361c1e0fefc89a4960c90a4d2cecd41a8379f285f0aa3e5b234f9fdedbcc943c655fd31400ae21e227fcf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d41ff0f73af4d2baa3538afc1d20674d

SHA1
c359150c77346d917e92265f51668f0c55add323

SHA256
45e3527de00b146fd908bb0345070582260138043e7e1e38d060eff2b8c18f88

SHA512
d27ea1f01140ae6f8493338e74ea9466f9b86891f35a04f26bcccb2b143aafcf3da7f8a1a43b9a3197005e6cb9582e347cfab8c11e92f06fa7f384287c11e220

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2c72881769ff89f32f6c5e7c07276da7

SHA1
7c7eb1e5740b38e701609143b85ded855a0d436d

SHA256
8be7ad80fd4dd0eb11c1a9dead8c2c92cada27e0f4cecb7b265aeef35c4ab6e5

SHA512
2b809390f0c1cc464797fb382426db38cd963d446b0a690071b7f1fcbdf5973f71900dc8927bb172e6bed6f3724e1e39dbf8fab27ea17435ba4b178ee7df205d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
60ab2a1508a821b25974e33206021065

SHA1
e442bdec6e7d4e72afad86c68385c0fda1e57c20

SHA256
2177b33b4f0fe53b509e40637a5d05ed1a7ea17f913f0558a75f2c0be54675d8

SHA512
5ef542818a71d90255ebac96bcf39307216a9086b78d07c7a95d73f3c1122a83520a37e6980d67b7e38c14fe0de7a7efb7ead10c85045b679449ac8d04c71017

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
981953598f79979200ef6887b2989552

SHA1
0a32ad3f751f23cefad142467ec43496e2a0a5d5

SHA256
58518f4468578a3ae51379f5126715cfe52ec479a226a75139a46cb0c8d6eeec

SHA512
d7e3f73590b0cb905e44a466a109d451975f26f2c3d097305f6750909292bf610a920375d857dd8657c15c97eb7a6cbdd7d7709e56c773b4306f260241862433

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4b4e00814686af6d3a56ec199e6ebb8d

SHA1
d9849464cc902b804ee91f2ecdb83dd2b1a6d445

SHA256
38096ffedf142565117fc2f9995850a4b3a9d521f1e48d331aeb5702d009562e

SHA512
3937471b72b987ecf0a7dc5cd1918d0b6c6b0c37430fc222874dad069383411a62ec6d5c22d10b2bdfceccf36d9a8184d60504386a1b701e6c317ffff2bbd856

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
147KB

MD5
2724bb35bd9b266be10aed253f4124a4

SHA1
c2aa468dc4c485294e9d2b13fb1b25d25e2b466b

SHA256
5a0496ba0766bd7f7ba358cafed7e6ca09f435aaebe8f1384ec70b2395a29f93

SHA512
7bec2517d35cf54c904d20dea1b277aa744db4799c439dc8ce0073ce038e9158a312cb08b197144e0ec231e224b8049b090902c9c15c5db31a553b24934ef24b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
72KB

MD5
02266e8cc8fcd66ad557b8fe8961b57b

SHA1
26510b25bb70a7bb2c9bad9098a7617d0a6f4109

SHA256
0d7fe69d019225bba0ab0a5c1e727dc9f9c137be4e0555a8baddbf864238b547

SHA512
5baa903dce6a19a77d1170fd99445ab3d47fd83652fcea8b7cdc83fa20f56b817be91449476647d4005b1915bcff1eb948f6ef688b730c6f2d0844ff2d369631

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
f2ec83e39e3a8f1b9675e9aa3d1f1887

SHA1
7f5db0649a62c4ff7f83efb8f48c229f9622c62f

SHA256
08127f06b97506f5ce12ab851382c916f6847c9f9f008c27cb5edbf1a141e352

SHA512
21874bf593d48f76f9be7c062dd08dd22a9edf007f68850a39a183ae06bc12e71e18714ab35572b6bc581eb51bdf549dce160242ebd75ea886577ed3eae11776

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
c55d18e30033f68d6fadfa59e38156ad

SHA1
775374c149ca846feaa9aaaa03f472625353e038

SHA256
7caccc983ef23e22243a55600b83d879f9532e1103301b3b2179fdc6767e53b3

SHA512
b58ec727179756998f5768d7fcd13f1b137f65b4d38f535988c8ac41d9fd7d90b09b11ab03bb7c2072590535e4795c6712b964949fb28c82849c73244e83524f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
147KB

MD5
04ece161812bba25f3efab2adbe81220

SHA1
263c43b35b7f77708eb5953951be04619ce261a3

SHA256
026923a2e532122296a3be3b9e640f44b495380ed27d61e54332ac98b6ea7f1e

SHA512
29a6c47a057e9a5e352fbd71d927cecda0a479957db96cd6da0bf26737ea98b0b6de4a667c8b0ac72c799e4ecd49a9ff200aad3301a90763ae2e4fe68ace3a87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
147KB

MD5
8767bcd75235d0d5fb4757077594211c

SHA1
ef94ea9d2f79f75aa7096761c030173dbadbc94c

SHA256
01f1a1fad61776bb7190cf32c3c5da5928e594a2830aba14b51883786c388f62

SHA512
f5b5c995e33a762a85887fe290266dfed363f36432774259708e35ad20d4794224b61fb5d2af80736594043df8b2c5f3165c1eff652c5bf427cb045b6d055b7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MCGKM0RN.cookie

Filesize
516B

MD5
4c8774af4f4e0107a7f5779f3bbf4254

SHA1
c139eab6d93dbf485bdae6a2972c109924f0222c

SHA256
4fd34df2ae9fa6b0b4fc87f8f91dbe6c814ff242275753daf98bd760597d8ed5

SHA512
29f5ecf2e9892f2d535734747be7899d43708b601daa6e9937c960335dc0dfd28d6a59846489ffb762cd8b5343a6b8c254383a36aea4c70d95205dfc3a60bb54

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.