cobaltstrike | 9daa8dff9b308513660f01f3dbec5cd1ba3cc6745f26fac102bb3531ca6fb587

Analysis

max time kernel
95s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-01-2024 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Arsc.exe
Size

278KB
MD5

6a4ed3098dbb71755fa1e160a6aa461a
SHA1

2ed9754964ffc5a1e555a3796cf0f22be4cd4fbf
SHA256

a71bb14f6ce7b1c6b021303cb76d01ab415c5a9ef18f853ac21c554cfa0b3672
SHA512

fff3ece980dbb3c589d88fdc3d5ebe2b82fb895c9fc7e92b91b09bba3c9bbdb5798a1819a1c59e514c99d74ccbbba6da0efc930b4ec82ae04d4c0d7dc2906b0d
SSDEEP

3072:7RQpBhyKgvqE9QvNgoLDPtHmSZQrDERejlDaw28oAejuZYBOhzhWUj6n:7R6h5gvqdlgWhmSZQftawx0Jmz/+n

Score

10^/10

cobaltstrike 426352781 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

426352781

http://178.128.81.147:3939/updates

Attributes

access_type
512
host
178.128.81.147,/updates
http_header1
AAAABwAAAAAAAAALAAAAAgAAAAV1c2VyPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAABJBY2NlcHQ6IHRleHQvcGxhaW4AAAAKAAAAFkFjY2VwdC1MYW5ndWFnZTogZW4tdXMAAAAKAAAAG0FjY2VwdC1FbmNvZGluZzogdGV4dC9wbGFpbgAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAAAAAAgAAAAFAAAAAmlkAAAABwAAAAEAAAADAAAAAgAAADsmb3A9MSZpZD12eGV5a1MmdWk9Sm9zaCBAClBDJnd2PTExJmdyPWJhY2tvZmYmYnY9MS41NSZkYXRhPQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
2560
polling_time
5000
port_number
3939
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYculBeZmrbMS1tUHgTa52vQn/jGzbJuxK3983bRJiS0d0xvEEpjfJ2NEtptZBL9yhhf8IIwbMBDqJj4fuVvUsHrQ26Zkxv0KrEuuIo60BUZ43Fcvi1VF555t4NL1wMOMPoz9NcxpSJ1Z+Am4vlaGTSg/Fxx6/0/Mh+UQMcZYvOwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.481970944e+09
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/aircanada/dark.php
user_agent
Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0
watermark
426352781

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2884 chrome.exe
2884 chrome.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2884 wrote to memory of 1824	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1824	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1824	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1456	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 940	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 940	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 940	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe
PID 2884 wrote to memory of 1508	2884	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Arsc.exe
"C:\Users\Admin\AppData\Local\Temp\Arsc.exe"
1⤵
PID:2328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63c9758,0x7fef63c9768,0x7fef63c9778
2⤵
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:2
2⤵
PID:1456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:1704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:3052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1328 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:2
2⤵
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1456 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3556 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:2116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3776 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:2208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3808 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3976 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4236 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4376 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1888 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3764 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:1556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3904 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4452 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3912 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:1
2⤵
PID:1112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:2548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1128 --field-trial-handle=1240,i,8687182127137929201,14893477797936496106,131072 /prefetch:8
2⤵
PID:1040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\Temp1_work.zip\Arsc.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_work.zip\Arsc.exe"
1⤵
PID:2104

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
acf15d041bf1f9cefb56773e58907170

SHA1
0b753fc2b08d599639864419adcd3bc3e3cdb4bb

SHA256
552a3ea6e3ef37ad260025ba0e2f7a94c21d1a0e0c5cc460bb9a918494dbbc93

SHA512
01354ed592dc62c398e2eb9a7b810bb83a66baedd20095209bd63b44a80029f044109cdf54053f392e95e4dbc1ee066c656e1109109e928271fc455fff411930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1fd6ea2a6dea6658a42ec912d125481a

SHA1
5b994a24fe946ad42d9e7a8d9a2050fe92ee34e4

SHA256
78aa285233faf57490b1e58c724d1c2bf572d19989b368f352e36f645edccd4f

SHA512
a366e73ce8f670b07f517cf917c86124371e643d6686618d9ec507d36fae8536649a0afccd2c5488dc2b895cf672e9859e3a52ce4ddcd0eeb9e8f5006f641f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ea7ac975244f346505a825b31b0b0e60

SHA1
d090ade6a8984a002123ab44cfabbed0013e98ed

SHA256
84717fa0b053f757a4bb18eeae391abf40542770fcaa80c87f08ba6b07aa6772

SHA512
29b3371d23e05f0453b382de18b1d8919015a549856594d3a7c1041d8c17e7b864f2e30184d4393ccf01aad8cea2f75c07e210291e0dac2aa92210c35054def3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
22247832236df4e02cf7e043765a3777

SHA1
2266b54f9c3aafa336d66b8897a4d1cb7ad59612

SHA256
5e46bb94e0dfdd44bcd1e4bc77d8a6ef45099792a7e3dbcc788baedab3605643

SHA512
6dbb16872825d1547c09493ed2180868d97d9e43425b31d341b83eeb2ecf4ee6e665cf309aea36f0eeea00409441d6cfecebba6b91eb462fd3b0f8e3c494d90e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
7a9c3d9a5b28f5a5ca4321ce34980654

SHA1
39aad399021435c117ee62683f6099273fc20e89

SHA256
acb5f549691a4765b9eae8000619583e765e477cb8637b2a7f2dbb0bf7643146

SHA512
289ed1017f8442cf8c758bec3b0194b23e90f3dffa4e27f9201dbef1119ae98428466af1a5a5e7884151581dcd71d728045853fd851d9ee191701a820a48de83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
853B

MD5
9d8a58eae6041525356d2d9232bc1a3a

SHA1
09147653a5c3b0586b952ec4c352e08cfa1b53a9

SHA256
8c55f2ad430f2c2fd8fbc0e9efae40d68d071303de202602d578fa2399bf74f9

SHA512
a3f1e9b1463ecf743520712361dc370f9a31885591e1c05244fdd9f9deb4e3b2bab283ae1f38dc7e65991a8078d7660e3e2282d061d6bdf7f1395e27c8931f9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
ff02209961fe56b6aa8db30a93aa47ec

SHA1
1b10de6cc2dc378156977c4dd2e3c35327f9acd2

SHA256
c2b46e92cca07b7227ec7de8df7725bb731be59aeb757cd2da032084a439ca63

SHA512
2216527ec29945d99e0e925b1e20091107ebdafea0f3ff68119940c6b0caa4f129ef4a7889a5e93c6e2f67bf70afcc2fd9833c46d1afb6d9c020d38a09f71247

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
b178f5f8c3f3ada8ac2b88205a123ea5

SHA1
e89a61f300299be4ab4f2e076b10eb69c85a1052

SHA256
c0590b543d19c481f082013608365b6cf630a8fc07422dfe9f5575deec77ce5f

SHA512
c5f233a1a7912f14373e33583c39196f1767023afb09f26ae1f6c2c4007a733838c1b983edd1263b21c0e6e5c72938809a11306b137284f576f75e5caa8903b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
fca9ccea2c3adf41105100ec1a8045f3

SHA1
07fbffe3528481d16a6c3929c4643354847d0047

SHA256
c397c5e314c7fabd7bc34b4260fc3e248c9c02cf9ab0c6a94fbdd0725a5dad74

SHA512
806131832197d3a24270efd9c9199436797b14f111f28864a762d8a545ec515132315a551fa9826677316a1aa49af9454646ce293191abec806059d974989535

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
122KB

MD5
c23c5ae416bb74af67cf39cd3040d194

SHA1
f3e3d62b513eb9db852ca9769c73dc6f8fffabd4

SHA256
5f77df6c26fe20c34cadf453b5229e526b0ca692dbaaf20ff9bc56fa3f4f9c8a

SHA512
6cd148efe54e5e1cd47aadd8c8b566e5b5f64bff55e099b3de61b482352aa8640a77ba0359d428eafb6de44d9ce2728e64dde40b8c54f707de6f7b20605eb3d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
122KB

MD5
398259897e692aedb8990685af309648

SHA1
a7dedf48d428fbecc7bea427fb87779e539df690

SHA256
41377c7dacefe5ad0647bb4f35712c75cbd5a877816688aba1b127442d874c28

SHA512
d987e2992fc554c202db560dfc7f64c60efe408e175fe7f233c3020c50bd6504cded13b0b3f7779f0fd538d50650eb98ba47b1caf9bd20769b8c4c67e181ba28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
81KB

MD5
c26ce9b2e53e957c919f8c413c9c1882

SHA1
952e10dacc290380290f3cabf5cc11de1caadc80

SHA256
3c446592ca156b287e9642babc555426fc1032b083964baa790956ac324ccef3

SHA512
f2dbe61fa3a5f209372317409a9aff2c945c2bc87347d060f4d2452ba9b778ab9f25ea029f2128fca3801b07bbbd5bdfecbcc9b1937c61aa00e3ffdacc31ce46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
83KB

MD5
14007ac7a18c454c681ed3a976da7c19

SHA1
026a6d51a4a4190b4f64127dd8ab3f7d279b52ac

SHA256
2bcbbf91570db6f3f5afdfa52419b38c51813f7cf92afd1aefd220fec54caabc

SHA512
80d789f69d6437e18474bcfd07a40b8d1a8c28b2bae9ded3fc51935824efe050fdf7301909860069504071ff82033382600c2be110c8f6239f2314f5b2f615a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBFB.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\Downloads\work.zip
Filesize
146KB

MD5
8194ec2669a12a783fa46176b7225939

SHA1
5da93eeab9e1ee54b5abef9de07c41015c7f0495

SHA256
9daa8dff9b308513660f01f3dbec5cd1ba3cc6745f26fac102bb3531ca6fb587

SHA512
30dc5aa95c2c0936979d4c79071138a7f349febf8dd35e7dadce2baa71d2eb3fa9dc2e9fc7c6c3a211f83d805bdb31b2be4460352c31db86eb213fb297568991

Download Submit
\??\pipe\crashpad_2884_ZFFKNYKDRMZYBAJZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2104-599-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2104-567-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2328-0-0x0000000000360000-0x0000000000394000-memory.dmp

Filesize
208KB

Download
memory/2328-1-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/2328-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2328-4-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download