38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 05:25 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
Size

1.1MB
MD5

4d75175c65da3eac9799eae3ab58c0f4
SHA1

4a7279866adaf8e96236c51de4a3f405a378bec1
SHA256

38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959
SHA512

2e4520e35a8b047857a81501632b2e27a6cb24ff744a0a4c919b485989df9639638144a2e932ed3691fb461e61964889b270f3e9cc9461ee2e48713ec559d7d6
SSDEEP

24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8au22+b+HdiJUX:2TvC/MTQYxsWR7au22+b+HoJU

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133591011418884741"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1772	chrome.exe
1772	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe
Token: SeShutdownPrivilege	1772	chrome.exe
Token: SeCreatePagefilePrivilege	1772	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1772	chrome.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1772	chrome.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1772	chrome.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1772	1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe	81
PID 1700 wrote to memory of 1772	1700	38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe	81
PID 1772 wrote to memory of 2828	1772	chrome.exe	83
PID 1772 wrote to memory of 2828	1772	chrome.exe	83
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 2200	1772	chrome.exe	85
PID 1772 wrote to memory of 428	1772	chrome.exe	86
PID 1772 wrote to memory of 428	1772	chrome.exe	86
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87
PID 1772 wrote to memory of 4020	1772	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe
"C:\Users\Admin\AppData\Local\Temp\38789f607a152032641eaa953ab86e7426c181ea0eab148933e16d433db68959.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e2dab58,0x7ffd5e2dab68,0x7ffd5e2dab78
    3⤵
    PID:2828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:2
    3⤵
    PID:2200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:8
    3⤵
    PID:428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:8
    3⤵
    PID:4020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:1
    3⤵
    PID:3436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4320 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:8
    3⤵
    PID:4080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:8
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 --field-trial-handle=1904,i,12617085417514551259,15802595391847903699,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4260

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4356

Network

DNS

www.youtube.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

216.58.212.206

youtube-ui.l.google.com

IN A

216.58.212.238

youtube-ui.l.google.com

IN A

172.217.169.78

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

142.250.180.14

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

142.250.200.14

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

216.58.204.78

youtube-ui.l.google.com

IN A

216.58.213.14

youtube-ui.l.google.com

IN A

172.217.169.14
GET

https://www.youtube.com/account

chrome.exe

Remote address:

216.58.212.206:443

Request

GET /account HTTP/2.0
host: www.youtube.com
sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Google Chrome";v="110"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-ch-ua-arch: "x86"
sec-ch-ua-platform-version: "10.0.0"
sec-ch-ua-model: ""
sec-ch-ua-bitness: "64"
sec-ch-ua-wow64: ?0
sec-ch-ua-full-version-list: "Chromium";v="110.0.5481.104", "Not A(Brand";v="24.0.0.0", "Google Chrome";v="110.0.5481.104"
x-client-data: CKHiygE=
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

consent.youtube.com

chrome.exe

Remote address:

8.8.8.8:53

Request

consent.youtube.com

IN A

Response

consent.youtube.com

IN A

142.250.180.14
GET

https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3Fcbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1

chrome.exe

Remote address:

142.250.180.14:443

Request

GET /m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3Fcbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1 HTTP/2.0
host: consent.youtube.com
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Google Chrome";v="110"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-ch-ua-arch: "x86"
sec-ch-ua-platform-version: "10.0.0"
sec-ch-ua-model: ""
sec-ch-ua-bitness: "64"
sec-ch-ua-wow64: ?0
sec-ch-ua-full-version-list: "Chromium";v="110.0.5481.104", "Not A(Brand";v="24.0.0.0", "Google Chrome";v="110.0.5481.104"
x-client-data: CKHiygE=
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: SOCS=CAAaBgiAr8uxBg
cookie: YSC=g2XKnuBqZfQ
cookie: __Secure-YEC=CgtfMFpFM215RzFpUSjUx8yxBjIKCgJHQhIEGgAgCw%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgCw%3D%3D
POST

https://consent.youtube.com/_/ConsentUi/browserinfo?f.sid=-8493181542502120632&bl=boq_identityfrontenduiserver_20240428.08_p0&hl=en&gl=GB&_reqid=19545&rt=j

chrome.exe

Remote address:

142.250.180.14:443

Request

POST /_/ConsentUi/browserinfo?f.sid=-8493181542502120632&bl=boq_identityfrontenduiserver_20240428.08_p0&hl=en&gl=GB&_reqid=19545&rt=j HTTP/2.0
host: consent.youtube.com
content-length: 117
sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Google Chrome";v="110"
x-same-domain: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
sec-ch-ua-arch: "x86"
content-type: application/x-www-form-urlencoded;charset=UTF-8
sec-ch-ua-full-version: "110.0.5481.104"
sec-ch-ua-platform-version: "10.0.0"
sec-ch-ua-full-version-list: "Chromium";v="110.0.5481.104", "Not A(Brand";v="24.0.0.0", "Google Chrome";v="110.0.5481.104"
sec-ch-ua-bitness: "64"
sec-ch-ua-model:
sec-ch-ua-wow64: ?0
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://consent.youtube.com
x-client-data: CKHiygE=
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://consent.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: SOCS=CAAaBgiAr8uxBg
cookie: YSC=g2XKnuBqZfQ
cookie: __Secure-YEC=CgtfMFpFM215RzFpUSjUx8yxBjIKCgJHQhIEGgAgCw%3D%3D
cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgCw%3D%3D
cookie: OTZ=7538726_56_56__56_
DNS

67.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.204.58.216.in-addr.arpa

IN PTR

Response

67.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f671e100net

67.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f3�H

67.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f3�H
DNS

206.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.212.58.216.in-addr.arpa

IN PTR

Response

206.212.58.216.in-addr.arpa

IN PTR

lhr25s27-in-f141e100net

206.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f14�I

206.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f206�I
DNS

234.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.187.250.142.in-addr.arpa

IN PTR

Response

234.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f101e100net
DNS

3.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.180.250.142.in-addr.arpa

IN PTR

Response

3.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f31e100net
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.dual-a-0034.a-msedge.net

g-bing-com.dual-a-0034.a-msedge.net

IN CNAME

dual-a-0034.a-msedge.net

dual-a-0034.a-msedge.net

IN A

204.79.197.237

dual-a-0034.a-msedge.net

IN A

13.107.21.237
GET

https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6 HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3E6A4854094D699200505C2708F668C3; domain=.bing.com; expires=Tue, 27-May-2025 05:25:42 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6BEF1BF2E8C84DED8A6288E2D8BB32A3 Ref B: LON04EDGE0906 Ref C: 2024-05-02T05:25:42Z
date: Thu, 02 May 2024 05:25:41 GMT
GET

https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6 HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3E6A4854094D699200505C2708F668C3; _EDGE_S=SID=0300D68B17EE658C240CC2F816A664D2

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=GAjjubGGiFGZoMQOn1ZQx8Pt4_4rAOoGjSx8pQjTLks; domain=.bing.com; expires=Tue, 27-May-2025 05:25:42 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EC44FB531F924F668E8F9B76754F54E3 Ref B: LON04EDGE0906 Ref C: 2024-05-02T05:25:42Z
date: Thu, 02 May 2024 05:25:41 GMT
DNS

234.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.16.217.172.in-addr.arpa

IN PTR

Response

234.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f101e100net

234.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f10�I
DNS

227.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.212.58.216.in-addr.arpa

IN PTR

Response

227.212.58.216.in-addr.arpa

IN PTR

ams16s22-in-f2271e100net

227.212.58.216.in-addr.arpa

IN PTR

ams16s22-in-f3�J

227.212.58.216.in-addr.arpa

IN PTR

lhr25s28-in-f3�J
DNS

4.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.178.250.142.in-addr.arpa

IN PTR

Response

4.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f41e100net
DNS

237.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

237.197.79.204.in-addr.arpa

IN PTR

Response
DNS

77.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.190.18.2.in-addr.arpa

IN PTR

Response

77.190.18.2.in-addr.arpa

IN PTR

a2-18-190-77deploystaticakamaitechnologiescom
GET

https://www.bing.com/aes/c.gif?RG=5f2c3b7f4d944b1bb1f6da0bc4e4aaa4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135204Z&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984

Remote address:

23.62.61.155:443

Request

GET /aes/c.gif?RG=5f2c3b7f4d944b1bb1f6da0bc4e4aaa4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135204Z&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984 HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3E6A4854094D699200505C2708F668C3

Response

HTTP/2.0 200

cache-control: private,no-store
pragma: no-cache
vary: Origin
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FD5A2965208E4C4F939B725AE09AC72D Ref B: BRU30EDGE0919 Ref C: 2024-05-02T05:25:42Z
content-length: 0
date: Thu, 02 May 2024 05:25:42 GMT
set-cookie: _EDGE_S=SID=0300D68B17EE658C240CC2F816A664D2; path=/; httponly; domain=bing.com
set-cookie: MUIDB=3E6A4854094D699200505C2708F668C3; path=/; httponly; expires=Tue, 27-May-2025 05:25:42 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.973d3e17.1714627542.113db936
DNS

155.61.62.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

155.61.62.23.in-addr.arpa

IN PTR

Response

155.61.62.23.in-addr.arpa

IN PTR

a23-62-61-155deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

clients2.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

clients2.google.com

IN A

Response

clients2.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

172.217.16.238
DNS

133.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.32.126.40.in-addr.arpa

IN PTR

Response
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

238.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.16.217.172.in-addr.arpa

IN PTR

Response

238.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f141e100net

238.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f14�I
GET

https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

Remote address:

23.62.61.155:443

Request

GET /th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
cookie: MUID=3E6A4854094D699200505C2708F668C3; _EDGE_S=SID=0300D68B17EE658C240CC2F816A664D2; MSPTC=GAjjubGGiFGZoMQOn1ZQx8Pt4_4rAOoGjSx8pQjTLks; MUIDB=3E6A4854094D699200505C2708F668C3
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QWthbWFp
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1299
date: Thu, 02 May 2024 05:25:44 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.973d3e17.1714627544.113dbe5e
DNS

86.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.23.85.13.in-addr.arpa

IN PTR

Response
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

142.250.187.206
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
OPTIONS

https://play.google.com/log?format=json&hasfast=true&authuser=0

chrome.exe

Remote address:

142.250.187.206:443

Request

OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/2.0
host: play.google.com
accept: */*
access-control-request-method: POST
access-control-request-headers: x-goog-authuser
origin: https://consent.youtube.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://consent.youtube.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

206.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.187.250.142.in-addr.arpa

IN PTR

Response

206.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f141e100net
DNS

139.53.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

139.53.16.96.in-addr.arpa

IN PTR

Response

139.53.16.96.in-addr.arpa

IN PTR

a96-16-53-139deploystaticakamaitechnologiescom
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

172.217.18.195
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

172.217.18.195:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 569
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

195.18.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.18.217.172.in-addr.arpa

IN PTR

Response

195.18.217.172.in-addr.arpa

IN PTR

par10s38-in-f31e100net

195.18.217.172.in-addr.arpa

IN PTR

ham02s14-in-f195�H

216.58.212.206:443

www.youtube.com

tls, http2

chrome.exe

1.0kB
8.4kB
10
10
216.58.212.206:443

https://www.youtube.com/account

tls, http2

chrome.exe

2.2kB
10.7kB
18
20

HTTP Request

GET https://www.youtube.com/account
142.250.180.14:443

https://consent.youtube.com/_/ConsentUi/browserinfo?f.sid=-8493181542502120632&bl=boq_identityfrontenduiserver_20240428.08_p0&hl=en&gl=GB&_reqid=19545&rt=j

tls, http2

chrome.exe

4.0kB
64.3kB
41
64

HTTP Request

GET https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3Fcbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1

HTTP Request

POST https://consent.youtube.com/_/ConsentUi/browserinfo?f.sid=-8493181542502120632&bl=boq_identityfrontenduiserver_20240428.08_p0&hl=en&gl=GB&_reqid=19545&rt=j
142.250.178.4:443

www.google.com

tls

chrome.exe

953 B
4.8kB
8
9
204.79.197.237:443

https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6

tls, http2

2.5kB
9.0kB
20
17

HTTP Request

GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De88RU92V07sjHUfL1E3i93RzVUCUzlyNxbeZgeHTSqpNc5zeizUwaDjJTwB0SXjqP86iU73ALgtZw_yMus5Z_hQx1A5h1vL3X7D_OY9ymaGnVxK6qKvde__jSCbgoSlibk_7Jrcp8OOgiyBNyDZ_y6V-t8bdvwXYD2U0FvVKue3SkP5wuB%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcf42516b54031f3378f33740e54789c9&TIME=20240426T135204Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984&muid=B64DD8ED08746C05824A19614CB097A6

HTTP Response

204
23.62.61.155:443

https://www.bing.com/aes/c.gif?RG=5f2c3b7f4d944b1bb1f6da0bc4e4aaa4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135204Z&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984

tls, http2

1.5kB
5.4kB
17
12

HTTP Request

GET https://www.bing.com/aes/c.gif?RG=5f2c3b7f4d944b1bb1f6da0bc4e4aaa4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135204Z&adUnitId=11730597&localId=w:B64DD8ED-0874-6C05-824A-19614CB097A6&deviceId=6825828828100984

HTTP Response

200
23.62.61.155:443

https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

tls, http2

1.7kB
6.6kB
18
13

HTTP Request

GET https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

HTTP Response

200
142.250.187.206:443

https://play.google.com/log?format=json&hasfast=true&authuser=0

tls, http2

chrome.exe

1.8kB
8.6kB
15
17

HTTP Request

OPTIONS https://play.google.com/log?format=json&hasfast=true&authuser=0
172.217.18.195:443

https://beacons.gcp.gvt2.com/domainreliability/upload

tls, http2

chrome.exe

2.3kB
7.1kB
16
15

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload

8.8.8.8:53

www.youtube.com

dns

chrome.exe

61 B
335 B
1
1

DNS Request

www.youtube.com

DNS Response

216.58.212.206

216.58.212.238

172.217.169.78

142.250.179.238

142.250.180.14

142.250.187.206

142.250.187.238

142.250.178.14

172.217.16.238

142.250.200.14

142.250.200.46

216.58.201.110

216.58.204.78

216.58.213.14

172.217.169.14
8.8.8.8:53

consent.youtube.com

dns

chrome.exe

65 B
81 B
1
1

DNS Request

consent.youtube.com

DNS Response

142.250.180.14
8.8.8.8:53

67.204.58.216.in-addr.arpa

dns

72 B
169 B
1
1

DNS Request

67.204.58.216.in-addr.arpa
8.8.8.8:53

206.212.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

206.212.58.216.in-addr.arpa
8.8.8.8:53

234.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

234.187.250.142.in-addr.arpa
8.8.8.8:53

3.180.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

3.180.250.142.in-addr.arpa
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.178.4
142.250.178.4:443

www.google.com

https

chrome.exe

3.8kB
9.3kB
10
11
8.8.8.8:53

g.bing.com

dns

56 B
151 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.237

13.107.21.237
8.8.8.8:53

234.16.217.172.in-addr.arpa

dns

73 B
142 B
1
1

DNS Request

234.16.217.172.in-addr.arpa
8.8.8.8:53

227.212.58.216.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

227.212.58.216.in-addr.arpa
8.8.8.8:53

4.178.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

4.178.250.142.in-addr.arpa
8.8.8.8:53

237.197.79.204.in-addr.arpa

dns

73 B
143 B
1
1

DNS Request

237.197.79.204.in-addr.arpa
8.8.8.8:53

77.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

77.190.18.2.in-addr.arpa
8.8.8.8:53

155.61.62.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

155.61.62.23.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

clients2.google.com

dns

chrome.exe

65 B
105 B
1
1

DNS Request

clients2.google.com

DNS Response

172.217.16.238
172.217.16.238:443

clients2.google.com

https

chrome.exe

3.7kB
8.1kB
10
12
8.8.8.8:53

133.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

133.32.126.40.in-addr.arpa
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

26.35.223.20.in-addr.arpa
8.8.8.8:53

238.16.217.172.in-addr.arpa

dns

73 B
142 B
1
1

DNS Request

238.16.217.172.in-addr.arpa
142.250.180.14:443

consent.youtube.com

https

chrome.exe

2.9kB
7.2kB
6
8
8.8.8.8:53

86.23.85.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

86.23.85.13.in-addr.arpa
8.8.8.8:53

play.google.com

dns

chrome.exe

122 B
77 B
2
1

DNS Request

play.google.com

DNS Request

play.google.com

DNS Response

142.250.187.206
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
142.250.187.206:443

play.google.com

https

chrome.exe

4.7kB
7.3kB
9
11
8.8.8.8:53

206.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

206.187.250.142.in-addr.arpa
8.8.8.8:53

139.53.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

139.53.16.96.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
142.250.180.14:443

consent.youtube.com

https

chrome.exe

2.8kB
3.8kB
8
10
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

172.217.18.195
8.8.8.8:53

195.18.217.172.in-addr.arpa

dns

73 B
142 B
1
1

DNS Request

195.18.217.172.in-addr.arpa
142.250.180.14:443

consent.youtube.com

https

chrome.exe

2.7kB
3.6kB
9
9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a11132f18e52b95c7333fae08a5c0e7c

SHA1
1cd58c7cf85eb1fbceb775def7857b8b0b2c0bd5

SHA256
d09aa837ff380a1440d340fefcba905ffad5e06011390a752237afdd90628f74

SHA512
6bec71735da310c458dd619fc6ab87989f7e4de4335fb14236931bb9ced05ceb8e4e6287cc0e18a044dd25dc14b65a9d416b2da0a0fb2a1c59e6447641bfe79b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
30675805dfd6bb57c634be73f75d2633

SHA1
17c5366b42dd83d4d5c100966abf824ee22eccbb

SHA256
f754aad970f807ab19669a502d4c8eb8b24038621a72d593e26c42efbb58ee9a

SHA512
f800ac4a68cded937992e4edc43c6210cd031a9e1c1e92874a121b2d7ca267ee69d9bbfc8eee59814938e2e8480ecab8d48797a99208d8b249cda8de252d64c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2eb07277a0a70b9552787a6672670f3c

SHA1
0bbfb321f4c5d8dd0ea5be6af83278e3f7205ec6

SHA256
0ca9f762caf5b86e453615d101add40814178fffb7f7be575411fe9e75a1cc7b

SHA512
97fffa9bd4620975ecaf9afa768dd009334425c41a9441446ba1347eb57f7788237675af3e40242234f5e38d56fbb6ce9b918f7dc91df66bdf6fe8a4e20d9797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
c52a06ac01d306341df13701f6d11fc8

SHA1
7ce82da9dd78ccb5a9b39c333bc4b92e02033a03

SHA256
128fe0f2e4051f3877f06c7502dceefa3cf1f6cce194530f5e7b46f013f6a119

SHA512
e7cd4e3495de6cf986fbf1ed7b5943e7af1708ba4a1890595a33c2d0d354a6f9918741f1ee1ca4904a5a3217f5135a4e6bb4296828593f96095f39bcaef860de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
fd768232e91112d010b17b5ae65e856f

SHA1
092d5edc025476350361a1d16179a295190bf0f1

SHA256
6cce61d0901726a8073d19096c8c89b5e429004c05ded17bfb7136eeeb7f603b

SHA512
40a10ec7ee447fc3722d317cddb97dba3a623971c67754504a1d975dde149734e5782664821ef9733d620b05ab3d1ebbad5f633ea297fd4a2cedbcbca0d61168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
66bd67c074c6cac0414bb94d677649d3

SHA1
a0f5203ff946210f47defcd9dba90c3268051c18

SHA256
9bd11d917993c654e9ce058ebfdb7556988eec89d4581cd1e1a2c4bb8b67510d

SHA512
34a671141833b2c1248531faf8a8321df588c3f04ce26e0242f5328fb4588f2a2b2f7939d92d3aaa51db74ab50b6d4c28497008166b5f3bd5f12546bfbc87d1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
a7a9376b0dad41b0be97f1b0dbb31531

SHA1
3a745175efa1487cac2f7100e0915d24abb2c946

SHA256
269d42dd09e26316f8e8876fdbebc67de7bd47b358099cf71a5d8938d7efc096

SHA512
a972963b3108ddfa36f3e968a275c319991b6ba9e91f0feb727565e084d6c97cbeb796fac8cffcdbae6c5c0007c6f27e27a0dbfd356871cc7d5d1d72f522fc4d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.