Analysis
-
max time kernel
36s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://albinofamily.xn--com-9o0a/
Resource
win7-20231215-en
General
-
Target
https://albinofamily.xn--com-9o0a/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301e4d5bb04fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{863917C1-BBA3-11EE-9B34-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002effc9044854a263bd04a8b50d356bb5e24aa3cb7360c54db417e03e3f290449000000000e8000000002000020000000928812dfab01350257f558fb19ed5cad4c3aa54fd90f9deb33aa0aac72a8df9720000000ede11fd85c7eed381feb0e62e3e9d81018164887cf503e0f07febb704b643f15400000008110d08ed2a435942457aa82cd41469f462865debcac00a7192fb1f47e77dd9567a4200ba613eac663326abedc724ccd2645ca43ccaf3d869fc915f8c17577fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d29f13a96644b46b3695253fb19a6140f09f5eb066094ffd574a45ce947c23b2000000000e8000000002000020000000e19b758c846f9c5b426b624f63d38125cf5f4c68ad6e35e08664254bee4bf3ff90000000403c035830076920fec79d8001deb0b2ed1a752430461f05fe6db862e7796f6926d857788b3b6cd393c44243af861d9df12f0bd8cfc2717e80c26ec11c5c78119b0990959e67ce0c4055c3a26076fb4b8274b79162cea09fdd276c8e33cf14cc14ffaaab55a78272e40944277a5a16d49beb9e3fb02aba7a3c1257d67107bd40fa8a34de1a7ef38d2b2e6a048f7f1a9b400000002cbe5f2e64f85d1fe51d5e03d415d5d2a0842aa34eedd179f5ac173b57f325f0b138c8a4a8e7c74418d13317dfadf02ea4561a5549540dd657fae9b522b3b320 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2460 chrome.exe 2460 chrome.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
iexplore.exechrome.exepid process 2132 iexplore.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2132 iexplore.exe 2132 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 2132 wrote to memory of 2240 2132 iexplore.exe IEXPLORE.EXE PID 2132 wrote to memory of 2240 2132 iexplore.exe IEXPLORE.EXE PID 2132 wrote to memory of 2240 2132 iexplore.exe IEXPLORE.EXE PID 2132 wrote to memory of 2240 2132 iexplore.exe IEXPLORE.EXE PID 2460 wrote to memory of 2372 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2372 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2372 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 2176 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1892 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1892 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1892 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe PID 2460 wrote to memory of 1888 2460 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://albinofamily.xn--com-9o0a/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72c9758,0x7fef72c9768,0x7fef72c97782⤵PID:2372
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:22⤵PID:2176
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:82⤵PID:1892
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:82⤵PID:1888
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:2236
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:2252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2632 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:22⤵PID:888
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1428 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:1616
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3528 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:82⤵PID:2628
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3412 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:82⤵PID:2800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1288 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:584
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3576 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:440
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2492 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:2888
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:82⤵PID:1156
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2412 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:1828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2688 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:2812
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2360 --field-trial-handle=1292,i,9530981700345167256,10017734045049278862,131072 /prefetch:12⤵PID:656
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57d775b845692641d437a50d11257adce
SHA18c7e1db662562e050d0aae3e088005bc5c4f1bb1
SHA2560631fd8ba886045df1e738a9b0531f09b558904e1192470c8fdc1709b898485c
SHA5127d0df8363dfe35f779ac950d955b0ac4b5f805b50447cc8ce92fe0c4cf2b86c3b16140cb06b48b6e807da91cd17c8ac19dbb03633e7f3f91127791de1740f285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5979588b62fc9e3ccde96d8c16b6c053c
SHA1fe5357c31a94fbcd813c6d3e8d3efc16fc3d903c
SHA256758db12ea5d4ec3afc70b7d3472b425c287c4bcacf80c2b23b9aab7aa501a0a6
SHA512dda79f3bacdbc3515911b7e1963ccd176f58b8aab9d179663cc6b5122ca6c7846c4fba4803812084f9e0ec04e4c9fdfb0cef038df4b6d5d45a517a04dcc9153e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5191fb1badce16cf5ff45ad1f85970715
SHA177f3f84339c1d39687adcb33e8659f8accdf3663
SHA25631d4c6a05abba8858012614581a60043491178ad46e2542003028fe1987ca0e3
SHA512d764f5c7c38d5447480aded67898d977dc0e290054c7014472a11369d4f05ee5ef79761b45f190bd5426261a272c2c1137f7a3fd380b67b6c36feae04d0a68a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54e9183fc6a6f372e4e2d1dfdd1290063
SHA13074a4b2aabffeac95f7106a152504ef77d4beb3
SHA25677a1c0c7e3f76c230ef29e1d96dc8483455ae5f688ff24783e6b854a6eb5515c
SHA5126a5b93cc2470be59e026d0745ca95fd80b51377799ef227f9979440ab80baef41a861706bfa25ea84e644f60e29018caab63c04eddeeddaa68e5adfcf8513215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51cbf0b52e236c95158c20e55a38db60b
SHA1ffe60ca845846871248b3a4de19120182ab85a83
SHA256759bc75157060044cb78959a66f2a0a8d913d1573e4cc8c784c9b131a6594953
SHA5122eeaa6081dde92cd410900f29bc4824ed3a05449553cc85039afe8084baab9d2ee96c54ff37a09b448ec96b3ac0247e20f2d846839b78447e4f0df1bf023250b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54ce5ab168ef39e2ded80b5c4f3412801
SHA142be6a693acaa77e4bb86f4d17f56a0a20d80015
SHA2564aac12a3dde5b934e34f0f708e1f7bb2da7409b542bd5b93c2f4fb05f9c285f5
SHA51259d006b22aa17396ebf4dc399304f93b51c931ae6e4a5be4c991b4b2bb899277fd330d01173864a7a2f86d3f068c5e84155dab73c3976f89b6dc151fbee017bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD551bd694803b422b812606bb4d834b8cb
SHA1da098b22b7729486556c8238218425bc38ae7f59
SHA2562824b1d2cea8e39570a33daacfd29d290646a4c6969c3499c3c8563866fd75cc
SHA51223fe38561c749bbb03bc6c00736c7da3fb886a2b2f1f9be179ec51e9623799aeae6a6376c5a05835a7a85195e55adfca135ca83fa04f933b4b5b6ff765c53fa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d4066bef2e0316242a4a068067fc8446
SHA13d63b3d3cb268cdbd6e9315a1247561baca7dae7
SHA25622116fe7d1e3a1f8887039ff88743f7b32cb319c1f8a437f5412573648369717
SHA5129590248d80cf8b7c1f16b012a65e718e29c928ed71c8b1b273b47de504d94cf4ed996237f0baecaaafd243d85ecb378188688e4841a75b36d5a935bba087472b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ea65fdf12bac80cd3f1ca50b11d01525
SHA1730e164f17496292d6c2cbd029f4b42fbc3bff91
SHA2568b6dac4c3a203bd5aaea2c1ed7e7a5e77a11e2ff0c21b417a9c75a38fc6cc18c
SHA5122c90ee055b8172102a3cdc3f00e8d64cc764ee52a3ca1e0b8d935e195e4b07af87a40bfbf51bd97a21f479cb3d64cac950909988578abcf7be1d2e11f49d4a24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5aa17e033fd52ac943cade81c42717aa7
SHA13561a2cb0c1ed469fb5389fe1053e20a6ef8ec64
SHA2565a25cb989a8f6375cd4232ef90d6b29178e51833698d84647ef00dfd2b2b92b3
SHA512f8efb88fae0a00a3fe8d5a042905682d638d6febc71cb549c3aeeac700bb240d31aa8e638bf446406090dfdbee803419ca96fd7fa3a32883799c928147f5f029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dd31ddc08adc266187cdabd6a6768635
SHA1902a509d9c61061de56412553d542632b9f2fbf2
SHA256d214c300316d3e3b68085d7437b146fd9f97de3c677e71c13729eea4b804d370
SHA5120e4d175d545ed021ea51a110abf1445b63df0c9c7b7f41096959c9693c49df72a968854419df37ab5a04308a24b0c1dfd4e648d28fe92c5f996ac6f3a04e90c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56a5f7fe8e00c160fa3e9f136ffd48c77
SHA133f95be26f469663f428c28d737e489893aae691
SHA25657f7a1ab88253a87974e80d8155760220156e34cf6235b179c8d9b8a0ef3a2c5
SHA512d8c006e650fc4cec7667f2603ea5553716101f17f5c67b7e6e197e0004d84cfc2e180e130810613bdbe36d1a47a7973da883ecdfbea15a55d1cad014c4804429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d07b822331569b61984733db1a9f3ada
SHA168902a9a11f02dc5726ec66996b703cabf3fe265
SHA25694ee447e9c75c9a99e5ed4d94ecf1906b0890c36d91a6155bc56f7aca303e935
SHA512fb7a2a2e030b13c39e72c802a17aa1217be0aefd4fd4c853c271ce9df20d964ba78c18440570f3dd075c6ff2bc973fd7aa050f5a576191f7b769fdcb406391e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d463e93ec14032707485924c755ee1d9
SHA1d87b80c28c18ce88ff5fd14f31526a167317e951
SHA25624f9b922c6c5056595c39fab989a0687bb7349945bf5ab15da84d3220258244f
SHA5123ec381eeda45f6748319c00490222a1553b30679c3e762ddc8c9e37a0bbb69cbce511d15e70072a226725cc5b921438cb51c84afcfcfa0b185e53de2e931db6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fb98c3edf4d3ca099f833a90fa4c533e
SHA12cdda6ef2ec56319c43c287967ccb7753ad180e8
SHA25614446ed2b1ce73e35822f407f7c85f1bdf5cd2800f6f999b3cd730a03c6473d1
SHA512ffbdc948853d0eccca0c56030b820803be920a0b920ed515144e5c901fe6994788093be78d6dd64c45bed42187d0c8c270803af90672b030da821d6795301399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a3f44c149a14e561af1970b255bc6fa0
SHA1d890b8e968ecd7190d55ed98e042cd650214c0a8
SHA256e38cd4b5d610bd7548f73b0f7f06773c4381710109af2c053ee4491466c93b5d
SHA512e03e50817bda25db5d6f4d7f2bd38c040e554884fc4d5e4830a5cf4a4e2f23157f3f4e3ef227abf188786b37dca337f1ae628d33e1909d8e745ab9a331db3f9b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD58277fd89fd2f31e6183bf73de8e58155
SHA1aa9973b2810304faa3c4aff7f6c4aff55b653b4b
SHA25634bc8f3cd82e5bfcf406710dd3c92083bcd73fdee7974c0c6232af016ba53bc1
SHA512980d817090c6c03c112ed83650e7dccfefa120fbd0ada9724fd76114846a91f258bb71cff6cba1f69266bda6fcb29bf715040b12235f1d50ad25b66cbe279c80
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD56c0d4ff22885cb44e2ed0db38ca4b675
SHA1aa55aae7d777aec0ff0f3ea37f32ac7fcf8795d9
SHA25627e6a5fec2feee7eeca61c969a26a2ccad1412f2c31a6dddc41033445534be0c
SHA512617f88fa10279164027584bad77c7bff41257795d8fa902eef91fcacb07eee4e039292824bb832d06165017852cf8b416b67816a7970ccb4a1430f183dd781d2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Temp\Cab7D7C.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar7E79.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\??\pipe\crashpad_2460_TGTLBDJKEYVHPHSOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e