Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
11-04-2023 10:39
General
-
Target
c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe
-
Size
1.4MB
-
MD5
ff106aa3d565307e8ea27bba9fb79e22
-
SHA1
f28f4c1252220398f887becfb28d22e147833036
-
SHA256
c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad
-
SHA512
8d1ecea32debd48a5cfccafbe1fabd05303408dd6d219debb59fc34dad4d14cc20d6ec9cf6a977ac2dcea4b507372550bf8a4dc88c72525e1a5d124cdb2cb178
-
SSDEEP
24576:ZVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEvq5h0t2W:XpJOl8xFMRy/SeQgi5OgW
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 10 IoCs
Processes:
c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exedescription ioc process File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File opened for modification C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2060 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133256831958322088" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4848 chrome.exe 4848 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exetaskkill.exechrome.exedescription pid process Token: SeCreateTokenPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeAssignPrimaryTokenPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeLockMemoryPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeIncreaseQuotaPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeMachineAccountPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeTcbPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeSecurityPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeTakeOwnershipPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeLoadDriverPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeSystemProfilePrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeSystemtimePrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeProfSingleProcessPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeIncBasePriorityPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeCreatePagefilePrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeCreatePermanentPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeBackupPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeRestorePrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeShutdownPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeDebugPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeAuditPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeSystemEnvironmentPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeChangeNotifyPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeRemoteShutdownPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeUndockPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeSyncAgentPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeEnableDelegationPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeManageVolumePrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeImpersonatePrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeCreateGlobalPrivilege 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: 31 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: 32 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: 33 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: 34 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: 35 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe Token: SeDebugPrivilege 2060 taskkill.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.execmd.exechrome.exedescription pid process target process PID 1012 wrote to memory of 5008 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe cmd.exe PID 1012 wrote to memory of 5008 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe cmd.exe PID 1012 wrote to memory of 5008 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe cmd.exe PID 5008 wrote to memory of 2060 5008 cmd.exe taskkill.exe PID 5008 wrote to memory of 2060 5008 cmd.exe taskkill.exe PID 5008 wrote to memory of 2060 5008 cmd.exe taskkill.exe PID 1012 wrote to memory of 4848 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe chrome.exe PID 1012 wrote to memory of 4848 1012 c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe chrome.exe PID 4848 wrote to memory of 4876 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4876 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1268 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1252 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 1252 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe PID 4848 wrote to memory of 4828 4848 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe"C:\Users\Admin\AppData\Local\Temp\c081277b1d6b3cadb265c6e848ef6a2834c1d374eae1ee935547a25728cb2aad.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe768f9758,0x7ffe768f9768,0x7ffe768f97783⤵PID:4876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:23⤵PID:1268
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:83⤵PID:1252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:83⤵PID:4828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3088 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:13⤵PID:4700
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:13⤵PID:1784
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3572 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:13⤵PID:4292
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4832 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:13⤵PID:5072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:83⤵PID:5096
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5196 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:83⤵PID:436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:83⤵PID:1848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:83⤵PID:1648
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2572 --field-trial-handle=1852,i,9895106818359410763,1949629004106406111,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786B
MD59ffe618d587a0685d80e9f8bb7d89d39
SHA18e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
SHA512a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
-
Filesize
6KB
MD5362695f3dd9c02c83039898198484188
SHA185dcacc66a106feca7a94a42fc43e08c806a0322
SHA25640cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
SHA512a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
-
Filesize
13KB
MD54ff108e4584780dce15d610c142c3e62
SHA177e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
SHA512d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
-
Filesize
20KB
MD5819e4d3f9721208585304425b25dd9b0
SHA107ee2670ccdc3fda74deed442ac537fb2982f646
SHA256e58d164a57c7f1cd4ec52401c6418a64b39face2dd70a61fa7e4dd488f6b71b2
SHA512aad97b1be78498f948c1449dbddd403c35ea7000403194e8ff6bafd7cc041b7057564a0b554fd547ac6336620d4d6f87cee539a2a78a60a156c2b6c47361452e
-
Filesize
3KB
MD5c31f14d9b1b840e4b9c851cbe843fc8f
SHA1205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA25603601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
SHA5122c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa
-
Filesize
84KB
MD5a09e13ee94d51c524b7e2a728c7d4039
SHA10dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
-
Filesize
604B
MD523231681d1c6f85fa32e725d6d63b19b
SHA1f69315530b49ac743b0e012652a3a5efaed94f17
SHA25603164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
SHA51236860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
-
Filesize
268B
MD50f26002ee3b4b4440e5949a969ea7503
SHA131fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
SHA5124290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
-
Filesize
1KB
MD505bfb082915ee2b59a7f32fa3cc79432
SHA1c1acd799ae271bcdde50f30082d25af31c1208c3
SHA25604392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
SHA5126feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1cc12c36-db94-4de3-b364-60d7cf8da497.tmp
Filesize11KB
MD556122b1c9366057badda7af8c0baf595
SHA161267082e3bae30defc1b5050bafb87ead851431
SHA2568842f4fa1920321a422dd26468b9ef5f76df14a05c4dd8d2cc6b336b70605942
SHA5128773c268f945f097483ff2eef8ed7401ae34cdb7e74f01eadb2f5e475f4f58b723d978914822d92bdd24636315299c33ec04d05412082f8a89ca1b4e33197da8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2ef92baa-5aaa-4854-b4e4-87fcd4c6924e.tmp
Filesize5KB
MD59c7a340d521d07b44fe73622405f0758
SHA154300e6c3b968a9cbe03b4de2e1761d774519281
SHA256ae7118ae53c205267576a413081684f6fff774c3a84a68c915a02383d011d9bb
SHA5126b204fb69100de1357854dde2b7a6cc556dd1d55eeba2c7ab7ebedb05149d53f324d49307ed83f440646df7e3ba0e3ef28e4572f93423b2b8ee34a06a34f8fba
-
Filesize
1KB
MD54a807a62d2c57795686c8f65d6181465
SHA1ec67bd549d12197cbc7bdb23513fa0143fab9b65
SHA256df603651754eff3c3dc433899ee668b28e5fe03a251a9d354d0b3aa486905b56
SHA512b33c781365820f4dd0a0ae83b7cd7fdbdccb5f98e13d2670057910f6739d0d7e81b7a2fe41005bba5ff671bff6c28b4dc1c77a67aa460041ec658280083841a7
-
Filesize
1KB
MD5b1ad909460f551cdafef70fda1fdcf9b
SHA1160e0222ac5e38ca1e6959be2dfa313fa6c6ef52
SHA25654743d3a18990504b61099ad4d1a0eb0cfe8a49b8a42bcb2d64f701f140f3882
SHA5123fcf743e8efd5f33458277734e3304334c4d8c60b14ee1e768a919d5b37fff264094609d3b12dcd95bed6e9e0b96779e97bcd7868254c6b2ee0a9c768f2959d3
-
Filesize
539B
MD548c9871ae08d028cc26a0a5ad74ff4d1
SHA1ca8c34652a6cc6c0a3645059d15b23603a0948d3
SHA2563f6ed69db5e60a6ac0770aa9105f7d2a961c66aebfbc9f5459553f6e0aea9518
SHA5125c90a83ac34e674afb8e3b32d205a6e16a525dc495dfd3b30f1f58af4309e64eed5c3218068d81574a605e9ca31925802dd7c3d372fb8d678ecdc451dc0d659c
-
Filesize
874B
MD52d2322b4d71deb408e0e8980b2ce57db
SHA1256eb7ed7e17440ccef57c7d9073b96c159824d5
SHA25654e16714f460844459bdc7665d5a9873dc08ea537e0ae68b41f22caec2f4d50d
SHA512dd64c2140907dafdc74de302ba877c3c0e3f8a764ff467a3960cf7ffc75e51beab9dbfb05722658fa5ca37ddd4bb8b9faccb9560f5638acbc2c69d08c1b65e98
-
Filesize
874B
MD5278b5ceb56feabd7753ddcf7ca5fbb57
SHA16860ab700f4d4e55d81fa9939847b25be17acb03
SHA2567e7cc9bae9ad826985b1ea2f1067608c5c17d91a85fdcfe3f93abcf6b2150321
SHA51226144a7e4006c8847ce4117e3252aef9ab30b98581c2352bb43eb574d08fd274c8c2dc773ee9b439f2520f09e85dccf487945cb14989048db1f65ddd1eb21f24
-
Filesize
874B
MD55b5c8c6958f03a0ca8afc54133409c39
SHA165c19424a2081846b1d3dd71840e8c41ef9bb9af
SHA2566b3fafefcad92ca63c3c98bcafb73a92e4b1aabf78147f502c90c7890207a16e
SHA5123c62d8349e2940ae86f70559fdef9ea5e74623b13a28769aae4e132739acf608d76f18868f9d813f7ba54527c2a9c15988a198ed5cc8aeae170763dd2ce3f552
-
Filesize
5KB
MD5330d77ef8141ac044e5e3bc6a6276109
SHA1a4284629f95d65e74556fe1af67959141fc880d1
SHA25682923732ffc70079636dc6a2f33f02b3bdab89ff879b6fe9c811f15708fa355d
SHA5122d31b69b7fc2ac7cdbca19cdb00c1331f9462fce1ed5e1dfbe78ab46650a0ec69100b055fe998aea2d0fe6055f6eecdb8d8439e2f3e66ded72181f1e9e160d59
-
Filesize
5KB
MD521ba698e70c894668ce739fc56598f64
SHA10e6068ce54ff4bd7a1208ca8b59a7cbdaf5cbdb7
SHA256e846b0d567660d2e0aef15d1efbb319c582165c3876d4e299f7b9dcc867ec63d
SHA5124dc440b46d7b7b04baa401f238b7be0056cb6c44047497ca45e17a6a8603f69a73a833ecf2406851b013d39804319fc6e019697b72731ba031126db14176f686
-
Filesize
11KB
MD5e18a9cdc9c0ce0ff4717287678ae863f
SHA17fdc7eda1db64560c5a72e4c1f8ef8280d96aa42
SHA2566791fb3bad0f67a943555c766a126296acc425cebd99fa563d0e938ae5639e7b
SHA5121c0e068a5b6e5d1441d2acca2e32adac13fca96ad7af16d9f6b3268f9bceb8554a4d62351398d9de17b3ecae861e4219a9625329d6021ba75218fdcc08591088
-
Filesize
199KB
MD5766a88ec2c9aa3823fb02182281a501e
SHA1bfd2893521b94d7546ddc5c21148216271d0d005
SHA2561fa1d7bad4015352c993b054712f89078db6fc7adc4e84005607e4e183bb6287
SHA512245c87466afdae79a3406c771cbad695fc3fbcf72170e97d54ac7ed703b2a8a27393529e3c853f790bc019eb98a9333b571bbcfa8b75790fb2ca365c0587e619
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e