Resubmissions
25-01-2024 17:16
240125-vtez4acchq 1025-01-2024 17:13
240125-vrmbdsbdd7 1025-01-2024 17:12
240125-vq4t2sccdn 1025-01-2024 17:00
240125-vh45vacaeq 10Analysis
-
max time kernel
45s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Textbin.net/download/o5axatp8j7
Resource
win7-20231215-en
General
-
Target
http://Textbin.net/download/o5axatp8j7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a0070dd7b14fda01 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11FE1431-BBA5-11EE-94C2-56B3956C75C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302ac1e8b14fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009899c500ba82a4eb99ab6ee8b16b92c7c001dc798726c2a7929a026ac5463fe7000000000e8000000002000020000000da28fe4af63a331f3879c18c2fa41b7405b1ec2414214d91ad1b0af17432ac6420000000ef1bef7dcc8c8147e23437441325e4a5f232b2261eb69c3d15cdcae7abb4e5c8400000004fa938e113471e69a3558a6f15b50bcaf88a2650dfcccdaef2f2326683d02df1c99e2589827fa34b987d29d2dbe1dd08f4c3161ad279e034adb971a77e5b3fbe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d49454a3705cf66ce1cb3d1d4f00a00306e93386d5d9cae6ae1bfd55b1e56c4f000000000e8000000002000020000000917be13a4861bff4cd23765c9814dac30011be9c9056fca26af4fd3f9a798af190000000790f44324762c9fbde02d50a988f8382232e66e366485d762b91e2a69189c11c9acc3feb03ca24182cb5bbcc8677052f0cd3d20b73c4eb9d56b0e54d5abb617b505c0e56005b439dc878116e680892a7497fa90e05b652f0b6b657d70c88d88b1cead307466e45a7a940e79473dd9775efaafb7b5bd5c9743fa6f82fcacaf21ede7ea86406c47107b2c9113282e32db54000000041683ae5c24000e90033925439a1c12fa1381868124ab1fa823ca03aa1cd924851a7700df31ed68598eaba86eee6d97c101a2452695d2bc3175c3c2915f307e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 292 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2056 chrome.exe 2056 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 2052 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2056 chrome.exe Token: SeShutdownPrivilege 2056 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
iexplore.exechrome.exepid process 2992 iexplore.exe 2992 iexplore.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2992 iexplore.exe 2992 iexplore.exe 1784 IEXPLORE.EXE 1784 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exerundll32.exechrome.exedescription pid process target process PID 2992 wrote to memory of 1784 2992 iexplore.exe IEXPLORE.EXE PID 2992 wrote to memory of 1784 2992 iexplore.exe IEXPLORE.EXE PID 2992 wrote to memory of 1784 2992 iexplore.exe IEXPLORE.EXE PID 2992 wrote to memory of 1784 2992 iexplore.exe IEXPLORE.EXE PID 2052 wrote to memory of 292 2052 rundll32.exe NOTEPAD.EXE PID 2052 wrote to memory of 292 2052 rundll32.exe NOTEPAD.EXE PID 2052 wrote to memory of 292 2052 rundll32.exe NOTEPAD.EXE PID 2056 wrote to memory of 2444 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2444 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2444 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2600 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2740 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2740 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2740 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe PID 2056 wrote to memory of 2512 2056 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://Textbin.net/download/o5axatp8j71⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1784
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\sniper.html1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\sniper.html2⤵
- Opens file in notepad (likely ransom note)
PID:292
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4fa9758,0x7fef4fa9768,0x7fef4fa97782⤵PID:2444
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:22⤵PID:2600
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:82⤵PID:2512
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:82⤵PID:2740
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2232 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:12⤵PID:2616
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2276 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:12⤵PID:2000
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:22⤵PID:552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1460 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:12⤵PID:1208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3412 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:82⤵PID:2428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:82⤵PID:2440
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3448 --field-trial-handle=1224,i,16941860412396132273,1467700733006800629,131072 /prefetch:12⤵PID:296
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD560fe01df86be2e5331b0cdbe86165686
SHA12a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5620e5da3646b275158aa4e557c9397ca
SHA1ab870b028e9990073f9b24fd10879bd22eb08eb9
SHA2561b08dc581d7e59ccd18fec7133c3b85089ab5ffc648bc5f55ca66f1d71d22b63
SHA5126710931c6b1f9a84dae06e7dd4cb1ba1ab2f5015a76480bdd1e36272cbec4ea4e07bb8e6f1d135d8dd99046ea0a04b8c93d1b32bb9225c971e1fc35df115bf50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fbd19211bcb93777400f021a4f0dde4c
SHA12fdffcdf96d7a4aac048f92bf4ce4e7a83c14dc1
SHA2562accc7ed587acc30b92f4bb717bee8159fb96f2d2772b83e01f72b313ebb6006
SHA5120c55757ac40ebfaadbd8a98ad432fb821c6592065ac111de7ae8d02fdf1e35eee53c1969d1b089026c1acf2e5f49e5e34c1144465fe3488617abd48655251128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD508b8ca1b85083fe310c2f0983bd556ef
SHA1607c025ccc800f4b233cb798f853891b318b7783
SHA25624821f05eb0a18d56ca464662ef5c20873297f6cc56b3a053220afd80b25bc81
SHA51249413040eda8025cf12d7de2bbf628d73f6029298678b6eb4a714e6d69b8842dfeeea138929671ad1dd2a101e80a45221727c19e596ab725f0a9e43302554fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59497de54000e39aa21311a5077ad70ca
SHA196c17ce99be430e6596fbbf87155b7f072f49069
SHA256ac7dc92e390040a9b1dc27f75bcaa9a1698dedffc67b4a3885c16876d7a6c20e
SHA51266e63336bcfb625270f0856bf29e076ea7fe5d199fef26dffa999a7465c7d98b92009a6292e0e4fe30cd0e98846ab9f0afd1f21a92d4252b7b24ffe8872b2ca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b213a6f639b0630bc5d850a4d5cef404
SHA1f12777c9b81e1a9c5775a602156d4ebc471efde1
SHA256258724a149396daf39630f473126750889285a2bee0d675419a23aca03419786
SHA5129bc062d2553b27ecfa66a106b97c844e9089dd1de8a5c2ebda040b2f3ce05a083ec68ed47507c47c8611965ab11f657e1e96428ae06353005d7c0b423ead851e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f21ffe3fc3a882ec58257c94dcfbed02
SHA1432a1c3c9e3a8d7bdda8a04df74d1d05c97b9832
SHA256e39757c5364b1d52d369540c1130d7dc759e1b5da84c1e707b8bc0dd6f06e037
SHA5129f6c12ebc904f9d7f6c8626761463c934bc162148092aabe421b381a40819897428a2fa1dcc8bb2b06e64cd3070d7a1cea627de784c488bf6e4e6db8c3bf4ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57c272f299bd2a3a2ca75d4b503057187
SHA1571ef5f9335c7d94fb440067a737c07a111d10a9
SHA25624e901ad27912902b1f9f7ed3da363aeee4fc5d71df8e2f4df251e4f290fe6c2
SHA512309b3a62eb5cfac6810d5241a672b929c160a6f60f0f818302ea67cb1728c8e0d0f607fd2474b3b49d72e57fc52b26e9b7da25067e0aeffbec62ca6400655327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57afb8420252467a3e4939f4c22f99d84
SHA137026c999aa24e8bcbc3b907eacb2e23abd7a99c
SHA2566165be643a0415da8d0abeae2bc34c91e489c19b93aa10a6c56548ec8121d61e
SHA5121332cc74a8ec790c48226ff016a7b6d447e7eb1c6b12790df1163a730418adc6f284fbc0ae8b017d6fc43458990192e83562862bf764cc8c0525aa7af2dc52e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD533e54c202cd42758253da363ce0dfbaa
SHA17aa0df04decc629875e021ed7128cefe3fa2d7d2
SHA2563a18c75c583678b8578a5ad6ee8467583c50b49c1e50dd45f974541931cd3658
SHA512b43acef80676462b2967facfd1d3ac163cd744d877e3867234331978fb0a85292aa3df48d49c126214815f41c6fe7d9caad1b6a5ea7f487498936051733124ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58d8c3a686c81271c5e602af73e6a306b
SHA1ffdb7c9a1ce3028bc8f400ab4c742a1c3e27a0e3
SHA25638e0a52475ad97eaa0458f3e4e7e808bb2f83c8e730f97ac00781e2a387e7507
SHA5121114c5357851f12db2da018cade3725fbc2a124d899118f79350a37e31e333ddad0d69458348231f50fdaf73e89eb33f3051155f969688f9611b4250be07aa75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a595ce83bacaeb651bf30af912325b08
SHA143b9419af9fb03fd367fa2f092f1b9b928f80ad5
SHA256b08c356e2bed3bbd40cdfd47c58cceb58a9afe1721059d087e043b975a171e86
SHA5125df3acf3d60fa4394daf5b3aaf9f703c4ebc4180631d58144527ce440b483a1955d9b47d651ad02fc8ef43a9f3fbe27f9b5a0e388ae288cafadbeb303498a3db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58806b87fd138344f875ef862074338aa
SHA15494794d9b8ca9f3ef4634b473bca625cab5a340
SHA25655e06f11a0239a89fc5a35d35cb463a722cf86962db8d7142032424bb5b3decc
SHA51239936308bf60d76185c0357747d8d63c90daaddd4778767b224ae78646920ba2df74f01137c6f5dd1f45f9564198d8f74e0711d18f659dae47cc08e8c0abc655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5247cf3871af849b435dcd53d48aa243f
SHA13f58528e08d94b6bc34043de4c1940ae3da1a21b
SHA256a26f349c6f2d126af4a1b89522b08fc28ddcc0ea9f2843c61cf3b0cd88043c54
SHA512ecfa42e268f03b62da4ee59644d4de0c9532a486f71adb209a711ac1da35d03f2c916159670569675b4a871955cd926b52a98a825f52d65cbebb937b976a871c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58f983b19b3e38b7c21e203e6a9dfa4fc
SHA12a72c8b7d6a217fdb6a6cc31c485754f4dcac54e
SHA25670af91d48844e4b78a10702734274566f5dbe5aaa0264e42330879a85cf1573f
SHA512d72583e62cd3a9c4d04ed93e9193474d23ea63afbbdaf4743de05c8d77c592fbab3d5e72cdf569dabe180bfddbf66599b4e0708252960534d26be3c4afe3bba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5d922177a06cf2c63457c76abc23ea340
SHA14d842252e41004e0d66ad8429d9dfbb1c6b6283e
SHA256e62600241cf7f005cad1308ac5fe7302b54b590d4b84fb54195f0f6cf5284f52
SHA5120902f13f8b91d52ab3dfa78a321243036a33f61fff7bd0e28ac463db4b4440108b1c09cf2d0bb6e3bd0e314ada1a1ea9128b8f7b80ae0068db8fd45659c5ce71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\sniper[1].htmlFilesize
30B
MD51e8f41eed1154070163d65e31897417c
SHA1131056f6336fcb63ec710df32e3ed8508b1ce34c
SHA2566e61e9ff2fd509e3dc0c44af3d750472ae01169f94a4a8436603a32f9bc0f51c
SHA512921811751456a4dee9452d53edc3010b5954b147ca9b62349629b3698f63f406e40d9a91bc9358d71ab9798aed4254ba996fb6405a98e64a8f034bd9b2781f24
-
C:\Users\Admin\AppData\Local\Temp\Cab9F4D.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarA04A.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\??\pipe\crashpad_2056_ZBVRRXALXWNYYVEVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e