de34907a1cb2927cfaad8bdfb1f565091554356c2b44324fead85441a71f5fa6

Analysis

max time kernel
869s
max time network
870s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 21:14

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-21T21:31:38Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_25-dirty.qcow2\"}"

Report Analysis Logs

General

Target

Chaos.exe
Size

14.1MB
MD5

ce7e6cff5faf679fa7432c5769969ff3
SHA1

56d6af18f439076a66e70a4c83a73c036cb113de
SHA256

de34907a1cb2927cfaad8bdfb1f565091554356c2b44324fead85441a71f5fa6
SHA512

88006ea14cb44f5af9362a8705dd50431fab3e458ffbc325beb86de599dd301091f07c1ba95028b32a5598d8949329157b3dbae0a9294f7943ab0976cbdf2884
SSDEEP

393216:qFy4mVBNnRj9Ksp4A8n+ygKGj/eoI1mKf39b6NxFqzFCknCA+e:My4mV/RJSA8+WoKmKPgPFqzFX+e

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chaos.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chaos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chaos.exe

Executes dropped EXE 1 IoCs

pid	Process
848	Chaos.exe

Loads dropped DLL 21 IoCs

pid	Process
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4008-0-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp	themida
behavioral2/memory/4008-2-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp	themida
behavioral2/memory/4008-3-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp	themida
behavioral2/memory/4008-74-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chaos.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com
60	raw.githubusercontent.com
61	raw.githubusercontent.com
62	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4008	Chaos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582078903081828"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{ED6675DC-FAFE-4944-A5A7-BACB887D5221}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
4372	chrome.exe
4372	chrome.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe
848	Chaos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	Chaos.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4496	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 848	4008	Chaos.exe	91
PID 4008 wrote to memory of 848	4008	Chaos.exe	91
PID 848 wrote to memory of 1468	848	Chaos.exe	92
PID 848 wrote to memory of 1468	848	Chaos.exe	92
PID 848 wrote to memory of 2032	848	Chaos.exe	106
PID 848 wrote to memory of 2032	848	Chaos.exe	106
PID 4372 wrote to memory of 1080	4372	chrome.exe	109
PID 4372 wrote to memory of 1080	4372	chrome.exe	109
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 3372	4372	chrome.exe	110
PID 4372 wrote to memory of 2096	4372	chrome.exe	111
PID 4372 wrote to memory of 2096	4372	chrome.exe	111
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112
PID 4372 wrote to memory of 4040	4372	chrome.exe	112

C:\Users\Admin\AppData\Local\Temp\Chaos.exe
"C:\Users\Admin\AppData\Local\Temp\Chaos.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\Chaos.exe
  "C:\Users\Admin\AppData\Local\Temp\Chaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:1468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9b774ab58,0x7ff9b774ab68,0x7ff9b774ab78
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1768 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4496 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4860 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4152 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4300 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3244 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2552 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5044 --field-trial-handle=1912,i,4773893207474443303,6618078411673054286,131072 /prefetch:1
  2⤵
  PID:3180

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1392

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38ee055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
dcb79a985216d14ea9e4a16141f22969

SHA1
fc98f265383ec2fb654fc4ec18c5ec9d7e8f3c62

SHA256
e190bc73ee99964c7cf1b4776d57e20b8f886a6f86687c70b3be1116009297fd

SHA512
063590612639bc2e9a6d43be54f5f884f2b1624a25bd67d83a3246c8c9d85bd3184ad69807ce726c2e39d524ca81b64240b55146376eb1de8b5bc94752a215e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a19ada0caf25b55ec06e2357e429c030

SHA1
993a63c093ac59ac75a9a2e50ca4cae9e4262100

SHA256
6b20837338300a116af334efb009da7ab9656a7bd1b389890ddb08dbf7439138

SHA512
1ae0c001d50b76c6e958624183e7eea850cd24f2caa627f3835d33feb4c083c72bf44e2f5f744ac4e809b9c24badad5c5002c4811b80749bfca43f526360f685

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b45e1f17e0cd3cd566108bfd673f1c73

SHA1
6582195aa6794afac9494e26300b1682135a9107

SHA256
0f79f73041da1cf71eda65499b2bf9e6c030e0273d2935e1ca55ebf4355eb136

SHA512
b3b826aed56120d5189df3a8018ee515d1071d6f40db620fa565375b05a40357b2ba2f26e8ebad4341420f41a99dcb8ffd68f11d01bb0f372bf864d27e84a402

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
94d1334a8d1a6c5a21cd440992571aff

SHA1
a88b6eab8602bfa85ee353d3a7241cf2c4672b7b

SHA256
f6da08541335ac499e115810d3d86d6252b91e61530f354140ae74b7c4e2cb1b

SHA512
685e2867165f576b046db6f09a43046a94458d00fe82dff6b56797961d4c6fb384f430dc16c4799dc3e7e331240aa611f83a3375064690df1277d559d3879072

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
09f9eca664d7bdffbfe1d62e45e00d15

SHA1
7d4a2ad8bc1a570cfac368474193bd9a9be26bf7

SHA256
a0a1a0e62e6cefde18904de9741f2aad0c3ef0a8812096d0e2f2e396e263057c

SHA512
9eeb51f285d7f8b006b58599ff4fc76b57a0b1367e854b7d1c1cbc11fd7d1bc4284acee5482ba1928aebf1526d02812720506c85c66ab714d62b5fefe6758277

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
23d1b0ecf35322e57c9cb315ffd28bd6

SHA1
d07349020e6b2480473e4c9812f23e94556fda63

SHA256
2e03bbd501906bda56ed55a3665b7ac56705bd31c5227fe856b7158cc02d1b5c

SHA512
00ba3870b6f211344237b05d07d1e2e08e24b4b3b4b189337f23136c8af20b65479f80584e884ca25015815261b87fe2696f9336b47236eeb5ddc61b4019f614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f2908a0252812593a991dadad7bb7f34

SHA1
d34159df9953fe42bdcd0f840d60d0fadb82b553

SHA256
1f98a4ca3330f993bebbaf9d99073e8de152bf0d8d23130fab41eaa7761953d6

SHA512
1a95fbc06bbfd5d2f470bb4991015c93725e80179b351015dcbe4053143986e7ff7b41392fedcacaf66342b77a32f1323eb28b1108c9aedcf624cc5bdbe6a2d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d1f7ceba3e3a99c0989c776bd8816983

SHA1
a030b4dc162b18df46699291b0466b96d1c56712

SHA256
c43ad43662ef05c265d8799996212c80a3e338c27d762373bd7f9cb50389d39c

SHA512
ccf55f4af7354aa163d34fd8fa0e2350f1f00309ad7273250b8a375dd1afd54b9514de33e0945b27ecb2057e64a3422902f04ce28db012cfc2f3781215a8a562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cb7cb2e8ac622876a359e5cdc4cc4e6d

SHA1
8bbb9812cf9d876663f01ff9de47365a7c1f9b59

SHA256
dadde8fdaa2b0e6498de39f19d8a46734afae34a1180a84ecb1ebff0989dcb15

SHA512
24a0c4f0559c9a03ba2c84bec78cb7f132204c39613ee7e47b8fb5bcfe5dda8d5e5eea1e711ea0a84c202f7c8999e8668a7e90dd4db6bfb4abe7dcfebf991882

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ce1b75e302ba02dd26f50e36078fee3b

SHA1
52e4aec6ac8ce15086126a14757c7f7c8eb5ad78

SHA256
42b685105db300bf005ab4d1dbb8778f59e3228f093174129b4e88e53cd91433

SHA512
9af8d042df22b9eeaaa8ec971b118801084a33bfda338df40a395e923af1ed764d38b04829ee0266e2df13b98a14807f01675dd540ab9a773862d8ac8b9940ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
b4d6a0cbbc723e0054a674d35e03265b

SHA1
84218f42e6df7518fb3d3321e1edfabe77f218fd

SHA256
7ca1ffbc0a09512fa99136cf781c4e4da40ba83c3faa52a2ccfd060f9f489bb6

SHA512
ecf0f37a801a098c319be683bfbc9db7c4e28d5ab96fc6a5c8abf6a4958c7183076b063c0c7ace29e828b0ec1e57cfc196925dbbf8c51fa7c91784cbb3936e2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
89528144d6964f837ae4c1fce0b70294

SHA1
2ade8552b28be66b155952fe2c70e60e8417f690

SHA256
9535d8e85ed10fe1e2fa1630be37f0f59705988c8bd776cc835ccf392c53c8cc

SHA512
22d0bd59a1d62beb134510f931512a7900788b2f7fda0618925a2c6d25d54f730dd11cbd7d1e26e1979c217f262fe666140f55520a14510b4e9ec05e52c2071e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d25fcc54bc7137e8149d735ee24c8ad7

SHA1
f69e7a8f43b3fe9c8a367cf47a3daed81d7f8c64

SHA256
b99ce08ffc125c048c5dae2cd7d8c749a576c8e28e66787b6509976148a01379

SHA512
4865d4a3fa51cbe74175b8ccabc256811f0e3d6fc543677514b3eadfbc94e953e687cd56bc82349ff1369ffe7ac75d2a79de66f1a561f6265fcf84e53477d526

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
9c6a8e0df92117d5bfed7577c32ba3d0

SHA1
f6c801f277c1caaa973e49011a4098097c6fb25f

SHA256
aead96d5183c499d43faf493336702729cc30df1113bbdfdbf39edace72d8992

SHA512
70d59cffc7398f13c8fb46c7b4939ba15d9970e1782773ce1428b388a203a8825c9a9e872592860f57bc4649347f4092960295291a1f385320d121792b4d6d60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
589d2dc34ca3d6caf7a66418ad4706ee

SHA1
b238a78d2bf987619eb20aafe1d8914bba3ba2d5

SHA256
8c6d0f2f660f1b0103afb6b02802668700b95815c58f857aa3cfc492ade8cc76

SHA512
1c13fd2e917fc064624882ea0d9e7bf0ed17e2fbd2de459d941038b1eeb8cf93ca1a830f2e0617406e8aced140358e4c34a799cafb93b720cfbe4f3090698896

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3f58cd4ef0ac93560df3d6c5ec1e9534

SHA1
655b2826c8dcd2bb4f6860d467715af5fd3a7df6

SHA256
420c9ed94c77e5d1210681c91d3938b67c4e1fbb0af8b2d90bcb10c9abbe82b3

SHA512
703b49285884bffd4588a55a13ce53b07fb5239a2e2f9ba942d12eb51b7290ac7438e29197429e2c08ce7989cb2d387672d69083fb9547fc6180be4a3dda4bdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
9280ee4e0d3bd62ddfab164380b4af43

SHA1
dce666881826adf147e1095edd00fc3ef072956e

SHA256
6581c18c711f88748cc9a267f77c03509649273678a07ba8ecac7746863c586d

SHA512
22d9a6fce87df2972daf238f58ac0cfe9c40d65f496e40e981ca159f06abf2f7f9966f3044ed8fe0105b487fc39856daf8912f22229039662e929ab3812b535d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f0b7e83e211782f281461da56d96ee6b

SHA1
685d39c2782708b44506f92a54094896f75a605a

SHA256
07f039fbe639b308d6be0b9d7fcd36c4c71e2125e01883b5db8c06138854a174

SHA512
c7f30ef055e0228dab8f455a3b209e879334787509e83e8c627a7489fa7d2f4bd48e457393c79a7400ac9049031efbbdf4d0798dd4c197ec3af25cd7d0369ec7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3423f664706eed1b96b8714598f4040a

SHA1
238a4375dc101d91ab0ea7e98552d6078953c1be

SHA256
b6ed64cda1a1a770b276e1aef956fd2ea4ab29c8b12ea1a3741db2f45e108c0f

SHA512
f95a6162fa878db856db3aca250ec6569ba994546d4299e96b1be52aa0b5f755f544b7b04f22e7a9e2839c81cab7cb0968391c22cd86258b7a5159a040e2b84e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d174368d5c5525da621e7930c113a003

SHA1
593a76c09fd309ce836864149785ab048c33155d

SHA256
5b657ec7d6a0937cae5993b918463810915083c9a9293a3b01ff5a9bcdb0df5a

SHA512
02669dc21ddd8afdb798a9d6fd5e7e04828c6c8e0c2fe3ed24f9219bdd2d963e760c15b42a15ea96c251b3ff60f5233f8b2c9642b6d752e2ca15bc84b0bb7070

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
429202c1fc36d5ec29c2082e6cba45a5

SHA1
a3f2cbfb293dce1bb73d9f71e3b7a5d4032a208d

SHA256
82cb6405642e1b7288a470a6a14fa697219a449f3e363a0e283490a020b4d0af

SHA512
e23b67347da3c6f4a4702fe09efd098a5fb13db679526c1370cb32084d7bd1f498fb95b1cb11ec5277ac0d003bed986e221c5feec9d35a49b35c928de426f6b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c46eb2c5ea1a352e1b38ca232adac3a9

SHA1
c662d16fad99bde8ae2708e0a2978c672f2856ba

SHA256
26faebe229ee7521f5bca10d14d1daa07418e93ebcc45df94069d44b125f4543

SHA512
ff66a3fa234774a2b1d18eeb57874efd7e23891c5b05d820792d4931c3edd6ef5a8a0893670561af6eb393fa1f4d2983c8148686b93c8fc7e8e0bd24a495654b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9f6013a0b6455d1d203cb5d573d0a092

SHA1
06b5762c3cb78648a37dee536301a42ab7ec29e7

SHA256
284ccfb8baff4c81a8e6f71c6f00078669ca053931a3a817e436554e58ce0119

SHA512
2d4eca6508d93e94b4af6b119985855989864bfa935b590f83a6b66c8d459d77eb1c77413255d9a57fdf32aae237f3bf148de983fe6ebb0b48b424d956feca85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
255318ad831925354fd7360cd11b649f

SHA1
5b393c47d534f80a822f7ba2c0c87b5fa0face59

SHA256
3e803cea1925269dff791ed321129df697622bf7a966a0789dc0a0ca9f0a0ce4

SHA512
253f06a70e3c7f69ee43518c8ed519a923c308791b9ffa7e216d316bd3f5b748c8631a07258f252ca769ae1120c5312dad91337e8eb8220da8006f6e00eed9b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c516fb1c424b4f75fd5077c016b58f07

SHA1
53368a2730675cab6da18494ae5361cf67d5a94d

SHA256
3d31f2af667c8cc6cccb39b42ab7058e7b0629a7d53a0343873a840b1ccd086e

SHA512
41ae62245a53bc4f7bad6b9128300791e8c25d5a5f9776e54314c956d43fcc3a5083cf524b3df5b23bda33d254583a8a17228cf036060f4026abf97d090cb6f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
0a7946e92b1dd0f27700f543f18c0b6b

SHA1
cc0a22bc59b1050bacd996367ffdf8a19bc31ae1

SHA256
2313c06480a649608aa5b6a16b064c1c26fb23544f0412d65d439a51ac25ee57

SHA512
adfb6d3f84c9bc37ae54ffe72583ad5be543ecfcaed117ef084e2f6f29aebcf87b5a768198398f84b2f40d252d67a95ab2f530d78d67f9702e70a96d55c7824a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
afd726d070889a5d3160911f6585b45a

SHA1
88966ea3dfc5296fa74c007d05963aea25e87654

SHA256
e6c417a5f73fb0efd3223bf0038a68d71f6dfb075b2dbc414d84475ac37132c6

SHA512
909442568bd6e6cbde7c14ab41c6b7863af32199b86839d2806ecc33834e84387dcba69c307a9c4f5f3ca71cf7b8f40356abe665aac7b4c2658d5c5585e9756e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
8075989376172435d9e4a34693d1ad6f

SHA1
611a5eaa0f2e6db701a0185840c2c84672641d3d

SHA256
ec38986454fac36009389f7372ed0667700a8cb2b136bec5e32dd2b0438042ec

SHA512
adae0f42eba465948cefd4fc6273757c285e3631862af545f3d6770cb1ea04155528514686e93adae9ee7d2be88c4e129e26718c47bb7343aa249bc1fa5d712b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
252KB

MD5
e3af67bbb065bea6d7e1431af2452cf3

SHA1
469fcc2764b7447d4a69ea6ff8c5ae932feb8568

SHA256
9cd7433a52482c2efba35ee76ae36cd855ec8b6cf08190f6895cb8beb2ef4363

SHA512
d34afb2180885c893d08a783b0101858fbb7591298ecbe559653068caeaee860845dd702183258261b79ae62b606d8b8ac582d8289b94a80f92521ecfb14aecd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
252KB

MD5
ea644c6f79c49101a868a512dcee1be6

SHA1
36617861812771149f0672fd221987cd4f7a1a24

SHA256
2fd1024ebe618d62502c4b0dd65cc636281d52d4e563bcccf1a47d27a3cc43b2

SHA512
9b9b8255fd3100fbcb3139b47f3c1c073ff0f3abe351fa2cc6df3911d1472cb6abad1d06abdfb40a52589ac274aee6ca60515402486734fc6b692a155a9e6f85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
89KB

MD5
e16b60bc10802111154fd80ecb758c66

SHA1
89399aae73c01257f4c3333bb187fb5f6555a184

SHA256
d04942250b87f08c79836a3ce5f7d708b6029b7940cc28581266610ae17348b2

SHA512
cd9ffed1510ac1cf7061f1b784be68e49d2702866672ba3afe00c59a9fc86f763c02910e81d80fbf9490d0a214ec581ab11e4e22c7165298b3dbee8074db0224

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
7e099784c7fbc3e8e73577f675ebec34

SHA1
832af6520cad2bf206c83a4e0b7a34b6976ccfe5

SHA256
c91ff77cfc31b4ada3144f16316f0f972b3d23931f37440ca02300b5491c7bd1

SHA512
db610da98da091e43077cfd63b88bf639809fa99fcdaf00bb295b1d66796c50aed3bb4e4cfbbfb55ac56f0a8c7021ebfeaaa5e697e30d6bd2ae8325c40ee84a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58c119.TMP

Filesize
88KB

MD5
d440aa98948903cacc00c14a3db4bda9

SHA1
5d294ecd33d3ca8c6e0b1adbe73fb75ba98eaad5

SHA256
b6097afaa829def98353722bd6c57e4188129763251fc1258d9b1e084b90f7b4

SHA512
0861f5b814cb8909a70978386b60ef08552daa0aaf9bad6def089a1212ac590c62f3a9f89a186b2201075c14471d0f2680fe7d1c04babe47874cf79747a29465

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

Filesize
81KB

MD5
4101128e19134a4733028cfaafc2f3bb

SHA1
66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

SHA256
5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

SHA512
4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem

Filesize
285KB

MD5
d3e74c9d33719c8ab162baa4ae743b27

SHA1
ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b

SHA256
7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92

SHA512
e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll

Filesize
686KB

MD5
8769adafca3a6fc6ef26f01fd31afa84

SHA1
38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

SHA256
2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

SHA512
fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

Filesize
28KB

MD5
97ee623f1217a7b4b7de5769b7b665d6

SHA1
95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

SHA256
0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

SHA512
20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd

Filesize
1.1MB

MD5
bc58eb17a9c2e48e97a12174818d969d

SHA1
11949ebc05d24ab39d86193b6b6fcff3e4733cfd

SHA256
ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa

SHA512
4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\Chaos.exe

Filesize
18.9MB

MD5
ffa809ae3c806b795fc642fc076884d4

SHA1
8a7417c0069c6547471af9d90537f05acf41d121

SHA256
77f210067f695893c8286230e6931e6723864672c528f30c15f0621ac4b2e81c

SHA512
14a538d55da54f83fef4b2a295d7baa4f04a6f8e95d93c645d870e9026f100ab5a58ba35887c00964f2c30ff218ca1ef33c9c88baeea7065417604c866953b14

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\_ctypes.pyd

Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\_hashlib.pyd

Filesize
62KB

MD5
de4d104ea13b70c093b07219d2eff6cb

SHA1
83daf591c049f977879e5114c5fea9bbbfa0ad7b

SHA256
39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e

SHA512
567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\_lzma.pyd

Filesize
154KB

MD5
337b0e65a856568778e25660f77bc80a

SHA1
4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

SHA256
613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

SHA512
19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\_queue.pyd

Filesize
30KB

MD5
ff8300999335c939fcce94f2e7f039c0

SHA1
4ff3a7a9d9ca005b5659b55d8cd064d2eb708b1a

SHA256
2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78

SHA512
f29b1fd6f52130d69c8bd21a72a71841bf67d54b216febcd4e526e81b499b9b48831bb7cdff0bff6878aab542ca05d6326b8a293f2fb4dd95058461c0fd14017

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\_socket.pyd

Filesize
76KB

MD5
8140bdc5803a4893509f0e39b67158ce

SHA1
653cc1c82ba6240b0186623724aec3287e9bc232

SHA256
39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769

SHA512
d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\_ssl.pyd

Filesize
155KB

MD5
069bccc9f31f57616e88c92650589bdd

SHA1
050fc5ccd92af4fbb3047be40202d062f9958e57

SHA256
cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32

SHA512
0e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\charset_normalizer\md.pyd

Filesize
10KB

MD5
723ec2e1404ae1047c3ef860b9840c29

SHA1
8fc869b92863fb6d2758019dd01edbef2a9a100a

SHA256
790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

SHA512
2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\charset_normalizer\md__mypyc.pyd

Filesize
116KB

MD5
9ea8098d31adb0f9d928759bdca39819

SHA1
e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

SHA256
3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

SHA512
86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\libffi-8.dll

Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\psutil\_psutil_windows.pyd

Filesize
65KB

MD5
3cba71b6bc59c26518dc865241add80a

SHA1
7e9c609790b1de110328bbbcbb4cd09b7150e5bd

SHA256
e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996

SHA512
3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4008_133582078298935410\zstandard\backend_c.pyd

Filesize
512KB

MD5
dc08f04c9e03452764b4e228fc38c60b

SHA1
317bcc3f9c81e2fc81c86d5a24c59269a77e3824

SHA256
b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f

SHA512
fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/848-435-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-718-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-543-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-582-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-523-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-595-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-476-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-608-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-124-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-626-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-821-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-639-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-810-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-658-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-75-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-669-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-399-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-558-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-808-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-743-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-358-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-758-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-150-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-771-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-83-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-784-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-85-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/848-797-0x00007FF69C3B0000-0x00007FF69D6DE000-memory.dmp

Filesize
19.2MB

Download
memory/4008-78-0x00007FF9D7370000-0x00007FF9D7565000-memory.dmp

Filesize
2.0MB

Download
memory/4008-74-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp

Filesize
19.9MB

Download
memory/4008-3-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp

Filesize
19.9MB

Download
memory/4008-0-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp

Filesize
19.9MB

Download
memory/4008-2-0x00007FF7E5D80000-0x00007FF7E7168000-memory.dmp

Filesize
19.9MB

Download
memory/4008-949-0x00007FF9D7370000-0x00007FF9D7565000-memory.dmp

Filesize
2.0MB

Download
memory/4008-1-0x00007FF9D7370000-0x00007FF9D7565000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads