Overview
overview
7Static
static
7CurseForge...er.exe
windows7-x64
4CurseForge...er.exe
windows10-2004-x64
5$PLUGINSDI...p.html
windows7-x64
1$PLUGINSDI...p.html
windows10-2004-x64
1$PLUGINSDI...x.html
windows7-x64
1$PLUGINSDI...x.html
windows10-2004-x64
1$PLUGINSDI...app.js
windows7-x64
1$PLUGINSDI...app.js
windows10-2004-x64
1$PLUGINSDI...uts.js
windows7-x64
1$PLUGINSDI...uts.js
windows10-2004-x64
1$PLUGINSDI...dle.js
windows7-x64
1$PLUGINSDI...dle.js
windows10-2004-x64
1$PLUGINSDI...min.js
windows7-x64
1$PLUGINSDI...min.js
windows10-2004-x64
1$PLUGINSDI...nel.js
windows7-x64
1$PLUGINSDI...nel.js
windows10-2004-x64
1$PLUGINSDI...ons.js
windows7-x64
1$PLUGINSDI...ons.js
windows10-2004-x64
1$PLUGINSDI...ics.js
windows7-x64
1$PLUGINSDI...ics.js
windows10-2004-x64
1$PLUGINSDI...nds.js
windows7-x64
1$PLUGINSDI...nds.js
windows10-2004-x64
1$PLUGINSDI...ies.js
windows7-x64
1$PLUGINSDI...ies.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows7-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...der.js
windows7-x64
1$PLUGINSDI...der.js
windows10-2004-x64
1$PLUGINSDI...ils.js
windows7-x64
1$PLUGINSDI...ils.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows7-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1Analysis
- max time kernel
140s - max time network
208s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/03/2024, 00:05
Behavioral task
behavioral1
Sample
CurseForge - Installer.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
CurseForge - Installer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app/cmp.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app/cmp.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/app/index.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app/index.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app/js/app.js
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app/js/app.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/app/js/libs/mixpanel.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/app/js/libs/mixpanel.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target CurseForge - Installer.exe
- Size 2.0MB
- Sample240303-adf71aba57
- SHA256 22fea802fc2cff8b7614f2aa6d344f685254781399649e26ecd526f8cc2aba3b
- MD5 4b1f36d729425503ffbbc59e93db1a04
- SHA1 c20680f948e64af482a298007c04a2bbe3dab3c3
- SHA512 3ecd5f23fdaf0df2b869b35d632d2fd7e5495f7ad7fd40d725ed448181f9274b2efc6d436644ae63011cad264f646685f9947fa7c013090b57143f84660e1aed
- SSDEEP 49152:9nG/ix6xE87vxpsrFpIvu7OJGWuMmtcFsuY7iNxCcbR:9Gqx8PN+TIvTBFE7bs
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 2464 CurseForge - Installer.exe 2464 CurseForge - Installer.exe 2464 CurseForge - Installer.exe 2464 CurseForge - Installer.exe 2464 CurseForge - Installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2156 2960 chrome.exe 32 PID 2960 wrote to memory of 2156 2960 chrome.exe 32 PID 2960 wrote to memory of 2156 2960 chrome.exe 32 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2656 2960 chrome.exe 34 PID 2960 wrote to memory of 2528 2960 chrome.exe 35 PID 2960 wrote to memory of 2528 2960 chrome.exe 35 PID 2960 wrote to memory of 2528 2960 chrome.exe 35 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36 PID 2960 wrote to memory of 2668 2960 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe"C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe"1⤵
- Loads dropped DLL
PID:2464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70e9758,0x7fef70e9768,0x7fef70e97782⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:22⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:82⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:82⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2116 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2132 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1600 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:22⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1100 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:82⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1364 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2500 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2088 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:82⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3752 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:82⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:82⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=584 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3416 --field-trial-handle=1368,i,11075637361457075443,10662238276575734491,131072 /prefetch:12⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2452
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc1⤵PID:1244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000004.dbtmp
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf79169c.TMP
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 363B
- SHA256 fb1d99c73920d3c37843030b42453b5d3c8f9ce111b8023ba628cdba2208ed92
- MD5 9c7dda6b2c9ca1137ead6b919804f2dd
- SHA1 a752f63163bd4040f3fee6669452d4ee4b362e91
- SHA512 9ec9bff890f605489977196c998be09e146c24b6de43295ed601cf4facd2d6b813c9efcdd9bb12704690e23ec30ef15947567a6961e7a73ebd007789f334c5c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 e574fdfb719bd3aa41d37c90ffcdbef0cfaa947289d68810ae5d4f45a662e8da
- MD5 2937b5a23c1eb798a02d3101f8070a45
- SHA1 8b1e3e6d168317e6a44f690401844ffbe2856f72
- SHA512 67f294a9b85fb2294d57265c91526b4d86ce297594e2321802cf8fdd699c387091e0e24116179b5b4a8eaac7c1df360761b94792f7d5eaec43576a1d05467790
- SSDEEP 96:UI4ltZKIgLld8iZRy7Di+6MsmdeDIOWY9HjV39:UI4Zg8syy+FqEIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 3d983619b4f3699c93806e4138bfc408f8730d5114e8ecc1eca4f4e805b13e0c
- MD5 6960f115ffe027f1fd66d1b159f0c5e5
- SHA1 b9479ce5dcdabf85d2bec814bcac362757eb5064
- SHA512 cfe4c002ebe88344a0a79966579fdd5689bf55ad30c2a94ba1dffb5c4810b5edb4c9b3156ea4da462c605d6507e217e1db7d2b63c426935a2a7659eeb3116895
- SSDEEP 96:UI4ltZKIgLld8iZxmv4+y7Di+6MsmdeMmk81+OWY9HjV39:UI4Zg8xQ+yy+FWk8IIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 e62409224b96bf68cffbb525178cd0c40c332eda589c57d4326ffe78d69e8417
- MD5 92fbda81926d221f2c3105a1b1bfb719
- SHA1 438b5179ab91d64b353dde929f0092c4d5ca0279
- SHA512 d2a73b3041554016230d46ee49ac586f38fb1fde7b435d99328afb8cf5cb4aa6c260cc6533081f7ba3c639a64c4f73e961c8f4c382ec3cd5a3bb17fd5a564b89
- SSDEEP 96:UI4ltZKIgLld8iZRy7Di+6MsmderOWY9HjV39:UI4Zg8syy+FaIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9ad89099-36f3-46aa-b9e7-022068f00907\index-dir\the-real-index
- Size 2KB
- SHA256 7d367be54dba371e83d7d86fb1b4f9a9350144cc198d15f190804700bb64bd26
- MD5 e956ccc7226324bc444778289f79cb3f
- SHA1 4d34b6b4e9a60334b17ec9d402479ebdebc1e264
- SHA512 e06c5ad3fe44267bcbb0202328b5b13b33ca412f29641d0252d165822d3f91e2d9859fe01fca5d06ed9389221c5d8f993cbe8dde5805f8e94d4efb712b18237e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d06c681f-9b95-49bd-a18b-7732ac6e8fae\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
- Size 178B
- SHA256 d8194ecdad8b06866c7e867a09ac28b41d4a02fc372cae665f8d0e2ba4609d0b
- MD5 dd1e84962568b0338526931af6e04478
- SHA1 ea63ebebdd7e434212f186c0038fec15d2970c3f
- SHA512 286ff6298692e0936a835f41b386a600fe2e69a3aa8cad67991ff072fa3aefca537061bc10c21e9811468832de396721870110ddf314e1afe1b6988f0ab2a983
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
- Size 176B
- SHA256 341d502f853f9f4696d565e53bf88ed756815ed4126bb72585b186d78202184f
- MD5 f9b072dd254c1617c67e3692c439d149
- SHA1 e4b0356c457a5da288757f01bcbb89e8a66cb625
- SHA512 fdc907874a2599d3593919128cc523612fdc35031a23b32c76fb1fe0c07a53bdfd788f7b0131b009c29f1f63614ea8f56f4b5cb1bc225c760cdf6e854bb10c3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
- Size 112B
- SHA256 64d31192bf2a3e3eed71ad41c52f525ba2ed293d088cacfd5a4792317ab815a8
- MD5 5335c0d715f28af78183ca731887ddbe
- SHA1 9232275690e9462048f6f9622fee342b8c1cb1ce
- SHA512 8b9a4ee17400173dd2cf25edf9fb9ed4a20c75b54761aa10d0c16cf61c0550a6344f172ac896b2c7474a5edc07aa1585393d4753e2650e26caece5fbe76fff3d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
- Size 114B
- SHA256 dd7ba6d9908933971b3a1f7ae2515fcde86ddd589d7be698c41b963b766943a0
- MD5 5652b7171b85787699cd5c5cc845e349
- SHA1 52e0b0684756e80ef65dc8bfa1358c71dd8955c5
- SHA512 784bcb0160a4306aedfda627812ac6082594afeb4497ad28ca486cc596b7e8bd5af883ef917353579c9b5b5b217a54fd261e7f30afcc6f7b32c7b4b27ce544a2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmp
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nst6884.tmp\INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nst6884.tmp\System.dll
- Size 11KB
- SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
- MD5 7399323923e3946fe9140132ac388132
- SHA1 728257d06c452449b1241769b459f091aabcffc5
- SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
- SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nst6884.tmp\UserInfo.dll
- Size 4KB
- SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
- MD5 9301577ff4d229347fe33259b43ef3b2
- SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
- SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nst6884.tmp\uac.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nst6884.tmp\utils.dll
- Size 55KB
- SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
- MD5 aad3f2ecc74ddf65e84dcb62cf6a77cd
- SHA1 1e153e0f4d7258cae75847dba32d0321864cf089
- SHA512 8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2
- SSDEEP 768:SmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26Mbdv03whn:SmLFtd9+O0fkV7xpD6wd0ghn
- MD5 SHA1 SHA512 SSDEEP