Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16-11-2023 15:56
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10v2004-20231025-en
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
MBSetup.exedescription ioc process File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
Processes:
MBSetup.exedescription ioc process File created C:\Program Files (x86)\mbamtestfile.dat MBSetup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
MBSetup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBSetup.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
MBSetup.exechrome.exepid process 1360 MBSetup.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
chrome.exepid process 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2696 wrote to memory of 2812 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2812 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2812 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2620 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2664 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2664 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 2664 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe PID 2696 wrote to memory of 1168 2696 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6cf9758,0x7fef6cf9768,0x7fef6cf97782⤵PID:2812
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:22⤵PID:2620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:82⤵PID:2664
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:82⤵PID:1168
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2204 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:12⤵PID:2896
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:12⤵PID:2800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:22⤵PID:840
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2568 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:22⤵PID:2920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1328 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:12⤵PID:2456
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:82⤵PID:2016
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:82⤵PID:1048
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:82⤵PID:1644
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3788 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:12⤵PID:2292
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3540 --field-trial-handle=1392,i,14303174634534655268,6105549462858931728,131072 /prefetch:12⤵PID:1720
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2888
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:1116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-10-1.bdicFilesize
441KB
MD54604e676a0a7d18770853919e24ec465
SHA1415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA5123d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1478c7cf-640a-40b2-85a4-bee94f80335b.tmpFilesize
220KB
MD5a62665d704017e682a80bfa2625a148d
SHA163996c4b33ddbffebeb73f1efe1a1b868fcd475f
SHA25606af3349ddf766ff4be31c7ff02be711928b469b223490c30327cba375fec1ea
SHA51221d8d2fbb7ae474e497d1884a60d24713f42494dca4330f6dbea865b7956ecd71d4e940897d70b56cb2e46c11fccba9157a967fc804bb22c0002bb7e61204dcf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5a94bb8492b7deaddf7939e1919b20c92
SHA1d2ae47686b3d672c64097a3ca01d7ea66590152b
SHA2563b2af2de1efbe0f2fb9400c959961bf940427636ea60f8fe138b63c56686b2fd
SHA5124fd9673bba52816ac2cfcac857c50fa4a7fdb9191eb27756d7ee09ee78ca09c2f5ba18dec6f29ce2037af242d93ad683c8b64497c010af7ca9865c3a995d78c4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5d2160cf19d7f2c04b439193b052af194
SHA11b38635f36d1b71b4ffb2359618b5c0a0ab6f71c
SHA256b943e9a44226324991691f75b351fe6a9f740d2daf39a842e08e25cf46b4912b
SHA51219358d8adab1f5055091c87e91430e3ddee5ef894e4f201e619488018eb50b6f7cdb001299628aa4597006482a1b17e0d5371120df1465d1c0fd92638f4e2aba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5c32c4ec965a2f5f987d13a7e265b0368
SHA17a3302febcb44002ba166b09cfa5a988dd1880fe
SHA256515a7765a6ac4b6fa976cf4549c0fa015bd509bfba822ad3e902913df529704f
SHA5127f22e4bf83c4944ab3a53aca16fd3771502f38f36ec2aefff157cda3d656d40a64b331f966d98055cbea85b6b7dc0cb60cfa720435d25e6912b9c622f4bb56d7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD535e5633b74bc9a6bc73452dc9340a0bb
SHA1f22b16e3816e792509f4fc277ba9bfebbe170c45
SHA25610c13b48e8edb60ac975ca9c8eb52e3000195e87b3f9488404ca683fbf014c5b
SHA512a4743356d2bdc014cdf6ab1379b0e2a233ea647e7be60bfc3e93797b1089ff161f943f5074e2d08b3b7dfc6cc8ab69a1df04bd9b9cd2bb1fc2c1b2cc1c1d8084
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
220KB
MD547712b96e2f9d07aac0b30ce58c0c133
SHA1dd7b7da0970cfc14d677e14b1c137bfc97c49893
SHA2560616ce842f8609fca3048ab728fc65f1373d3831992fa30ae084d463ca8b9d58
SHA51238beb19061a83c92689b32a4c7ec4dbf3e1c2f090a4ca05787f27f92108127b1b1a34b645d21a11ef0a8718d79e3a2f06bdc30f21b2a3e5eaefdefa1a6d4271e
-
C:\Users\Admin\AppData\Local\Temp\Cab8F18.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\Tar9458.tmpFilesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
\??\pipe\crashpad_2696_SJTVVJWDSJJBEJCGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1360-6-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB