hxxp://fghfghgf

Resubmissions

04/01/2024, 05:45

240104-gf53gacce8 1

04/01/2024, 05:41

240104-gdmhcaccb3 1

Analysis

max time kernel
109s
max time network
167s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fghfghgf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20F36CC1-AAC4-11EE-A675-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000fb247d87131c6eab15605085c87b8ecc9f66f3a8109cb8a41a85a49da9675df7000000000e8000000002000020000000571118ef3f6a18616642ff195495094d593c46ceb9a31a9c53c9a1dc73a08267200000005621b38618893c341ddc6643639ee1c379f2a60566754ab6d8d2949da18b05c74000000031b6bf6c07f5a8376f2542c89c528304db8b88cbec08fc6f1a876a3ee424cb2e7546badfac1424f5d3fcc13f4063cc399655626d97799918aac9518fd5573e1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410508854"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d157fad03eda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ede42bcb3a22dbd5da5258340a2aa69293cf6cdab4fac0c39fee44792ce66d71000000000e80000000020000200000007afa653c2d9bda2bcf28a044c387a5f86fcc356d886d7e3a188fac13989ed22d90000000e7929d0b5446e3caf7a32073179d856efbf29b521ff17d68b50f5e27775ecc74823d63dd2d5f68dc97e58de2898a9e24899aa6a58250a4b179cceb2bf46fb1f9d16748de52b0d8189dc6eac339de396b65b4708d15bc96c1926058a7c4a34bd414cbadc4305b92906c83a92f34bf5bde92fb30852ce4d4fa0a332ef29d8b0c219991c0bffa536502a3d9af18f7dde78c40000000960c82c40a6eb59d75c3a6e696e9c961ba01df623c36c8e192b0348d9257f3f5f7acc01682afdfaa7b9d2fd5d9e49755d171a046cb151697bc6e20b5dd98741a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	chrome.exe
1588	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2264	iexplore.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE
1020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1020	2264	iexplore.exe	28
PID 2264 wrote to memory of 1020	2264	iexplore.exe	28
PID 2264 wrote to memory of 1020	2264	iexplore.exe	28
PID 2264 wrote to memory of 1020	2264	iexplore.exe	28
PID 1588 wrote to memory of 2392	1588	chrome.exe	33
PID 1588 wrote to memory of 2392	1588	chrome.exe	33
PID 1588 wrote to memory of 2392	1588	chrome.exe	33
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2692	1588	chrome.exe	35
PID 1588 wrote to memory of 2024	1588	chrome.exe	36
PID 1588 wrote to memory of 2024	1588	chrome.exe	36
PID 1588 wrote to memory of 2024	1588	chrome.exe	36
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37
PID 1588 wrote to memory of 1060	1588	chrome.exe	37

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://fghfghgf
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6479758,0x7fef6479768,0x7fef6479778
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1412 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2776 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3288 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3548 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3568 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2296 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2748 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3880 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2456 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3944 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3960 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5028 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5276 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1244 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1240 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5144 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5068 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5280 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1264,i,16643391395530457435,14198403546336600328,131072 /prefetch:8
  2⤵
  PID:2560

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2296

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x554
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4684a310d44736627317544d5b0d4f3a

SHA1
1e10b78b7ac65cc922488626a0b0e3677fa342fd

SHA256
a543c69a5dea2feda5f289a327ee61545d88068216a101af1d9633274232bd35

SHA512
96cff7417d595f34350a6ef592aa83437b2fb33267b932e41a1bf7f4ece47d895b9807197d160c5b77bc125f75b2576963d1d5ebce5c41b267c3b78c4132e5c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
069ae293f00c62623f0c966bd1bfcb3c

SHA1
65272db1c5c9d4921129ac122fc7d066b74c15d3

SHA256
f2ee9e46d34cfe7a4e8c484d1915a38b69c59535b85c4bc17494190ebc4a4ed5

SHA512
44ad30c1e1680524a90aaac19a76734bd2d1c06bf375961e7f6e275741fef4555b101192265b35c1f82f51cf6395e1bf708e2e950327653f3d55648305b28773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b428dfe38a22a746fb3d9428ce4c367

SHA1
11ef18c4985d7aa98134a8dbd5afa152c78372fe

SHA256
ed1b629410e3400ffe09fd9d24bc817f1c80af5687757c216545d3255f05402e

SHA512
547556e4c0e0da1f52a007193041f86c7dc21025a12a2f54972c93c18811b2d1235ba01bcdb1fb91b1a9c627b3368e82c7b7b439e60aec37b91a83c5b78c4e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201baf2e798fce87d6d581d8dd26dde3

SHA1
4b92f629a5a7a1375183e14a393e58f1bd201d62

SHA256
12126e294843e6a94c1356abef640277a67c73d9673700b451ae6828589215b4

SHA512
9dc008cb2a18fcf9c1fbb6408d8e2ed9b1480718c8ef643862744888ddc33f1a608d806bcdef9e10cef37a83051306f34675794492f1fafd9c2d5afc2d32adff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a1ef053d6efe7700e20061bf9e75f49

SHA1
19b5977ab0771e57fdcaf952088c4f484f6d92c2

SHA256
171011c178a160564b6be41d6411d956168b2d6b805fe7728d6b2e43674301e0

SHA512
4c6c49ea583cc03573a67ac59d6473a5d1e45f2d2833f20690832cb203d8ade168c14773302c59e8005334fa32bc0633c086a27cc17ecd707369b1e81736e6dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
381431cadb93f69ab5358f5d8ba50916

SHA1
b416b8abfa1ee1484fca95fb5c1422c0d2db1381

SHA256
bb3e42f4c48b2a1bff8babfe82fa6e1878aa793e63ba0f0467a50128247cf203

SHA512
303fae8f58d0f567028b2db2a4cd4128089d754b499deca9a9e4de10d8b7c6d115fd4adda463bb88cef7f7afb2f0abc1d927e3c2dccf65dfaed60cbd164abbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
910b992f59c86b188ac278046a5c9b0f

SHA1
170369c300c5a0e4b973c43fbcc7d207ac8fd3f4

SHA256
7c9948aa132d8796ae864b59fd64c96c5816e2835ba6f81b957d496c86473d99

SHA512
3b5ffe0538491ea35ecaff7e7cba51ce3eae22cf024879dffc0d96c3be65512e7e5b0712fb179df8a001a5d764dcbc677a6eeda586e176667e6ed95e97baf951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8563760e7f450b1923dce51e7144510

SHA1
aeefe20f84b3fcf35f5e2cf997206113eca21a11

SHA256
1df5b4b65f3683fa8296a6aa885332002db5e35e71ba6b9e8949f049f8e01be9

SHA512
9482d3d6cf0e837379a41acdd1bcd7529becc3fe37ec9b16e1cb8e1f4fc1e1c9b8321fe60a146ce44a615bc901b8388e40c432e96ae77992d6c2ce024a8a5d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
806c3d688e19942b47fc82f9a722aaec

SHA1
67a1a4543450dbdb00d23c531872c77c33f5b0d6

SHA256
ebbe08dfb062f30e636e4ce217f7cd63d1a9f992eb8a6e1d78194a81cf52c6b0

SHA512
5578f43e5534860dea48d1c42654262b4b8efd5f6aff38f19f83936b6e58b9f47af90ac879e34f94740973ec9bb6bbfd8021d1ec010afc703980ebba9b8bb3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
794e2022b57f3ab7c40691996912dcf3

SHA1
029a9aaf0adbc6770a096b59befdb72b9c716b4e

SHA256
9332311c484722c283ceb722d78f1ebe5ad06ad1524b4d940be46bbb234d228d

SHA512
26b398319350506be2dfcf9d1abed8a51790d72e2573a9943663ed953e6c4a1bdc51857f414a8c090e81e28c0de8a9a6a48f2cedd5e716db1a64f41d28a5c2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0b85a9d6cc3c7782b44bf72c803f7a0

SHA1
e60f3e6677abfe6a5f16b89689677dbb40da4d33

SHA256
8b3906de3681b4ecb924298500135ef23f363dc5c1186994560ee2e1db0ff3f8

SHA512
89f921178c695f1bd365dc8b1db3f9debe720d60744ea7ffa6fe16ee49f47ff4f47b83c5f3a6572b44184fe7c48ddff967d724e06b706c3ff6815d4bd2cec876

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RFf78c85e.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
be52d762b1a7b79887897c80063b3e83

SHA1
8b283ac24206212775b1a3345325f157f016bf6e

SHA256
519b1fbbd0efe65031c5c3e75f94051313660ae83a3a7e4c52470b14edd5a8c2

SHA512
f3b17a22b592cfcf45a7fd0ee085f1fc8d3d05e95108ee783bdaca7f335acee3cea1e3870ed9a2b7f95d38f9628799039756aafd1fab5bb23ce5b7049919ee33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
93a97d9e72913761264107764340bb06

SHA1
198a0fbfa1f475165e906a76b5ff3fa15192c015

SHA256
0605c2ac84afad90068798087155a9a8ca00dbaf2a4956fc79f241975570129f

SHA512
20ded597caad392453d4d56f273ddd03c38a6682fea3ab2a7fa337100a45971ef2d13b22c241f205698e0e99c456a720a3ee952d6fa5732b30778e09d281d5b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
43370789f1fe9d5c0757dbd12feec591

SHA1
f2b924733bdeae3c39b56cd3dfecf8db5c929873

SHA256
101dc06839b562d103fb24f405556202516c78effb6dd34c05e4ffa6d1a59cf2

SHA512
5e6e03983e32b44d4cd7e175fd1a3e160831a26c7d186b71cce484a0479b10e9a7c901a1072cc8edf993fc1547257c710382349028ef1ac25e67158a648f46e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
0465f776b3ad1e83b39e74f3d49a5468

SHA1
c91c905fc3b8cda54ce94333cbb29bb83b763420

SHA256
19c3c30b4fa456993a1e946527c2d3fccef696be3724f2721cfa1f990d610bf7

SHA512
c197b8ff5f90cfac2921a3243463ee5863c55f8d318a297d6f04f65148336fc2f63c3adceba7ac789c4ae20ff2553a445a307434db324854e01e1f144c3ac040

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
225KB

MD5
0a81fe33d7e8a083482875b17c5be4c9

SHA1
ae3d2d7d03cb7d9727485e470a4ae4cff2733c68

SHA256
be968a9de14e392ec614869f8e1324b457c3ed8154bdbdc3ca992f7191a630cb

SHA512
7822985bcb3dbe96295ab352c6346401027688ef0e99e64ad2f429a528aa3938b85b49cf1c641fafa792bd89aa03b67610cca61b8dad1c46dbb733738a56deca

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD396.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD80D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF9B7C0C34A17A76F3.TMP

Filesize
16KB

MD5
86a9b0bd370634f2867c04aa58504a66

SHA1
16aafce7f1c7436395ec785aef50d0107f044467

SHA256
d64b74700fd9b23584a0084d4b7ee3ea37382c69e5004c647836ec2360a90bcf

SHA512
1900067dd73ab850d1a18a850c675202050f768291fb8dce6e7dc87c2bcf1b4c6b39207af879ac01c8773c29f1f74625bb0f7b6fa839a42f9a367e244c9d4a1c

Download Submit