Overview
overview
10Static
static
3Ransomware-master.zip
windows10-1703-x64
3Ransomware...ICENSE
windows10-1703-x64
1Ransomware...DME.md
windows10-1703-x64
3Ransomware...omware
windows10-1703-x64
1Ransomware...er.zip
windows10-1703-x64
1cerber.exe
windows10-1703-x64
10Ransomware...ll.zip
windows10-1703-x64
1cryptowall.exe
windows10-1703-x64
3Ransomware...aw.zip
windows10-1703-x64
1jigsaw.exe
windows10-1703-x64
10Ransomware...ky.zip
windows10-1703-x64
1Locky.exe
windows10-1703-x64
10Ransomware...ba.zip
windows10-1703-x64
1131.exe
windows10-1703-x64
3Ransomware...nu.zip
windows10-1703-x64
1Matsnu-MBR...3 .exe
windows10-1703-x64
3Ransomware...ap.zip
windows10-1703-x64
1027cc450ef...d9.dll
windows10-1703-x64
10myguy.hta
windows10-1703-x64
3Ransomware...ya.zip
windows10-1703-x64
1Ransomware...nt.zip
windows10-1703-x64
1Ransomware...ex.zip
windows10-1703-x64
1Ransomware...na.zip
windows10-1703-x64
1Ransomware...pt.zip
windows10-1703-x64
1Ransomware...na.zip
windows10-1703-x64
1Ransomware...ry.zip
windows10-1703-x64
1Ransomware...us.zip
windows10-1703-x64
1Ransomware...ibrary
windows10-1703-x64
3Ransomware...oad.sh
windows10-1703-x64
3Ransomware...est.py
windows10-1703-x64
3Ransomware...st2.py
windows10-1703-x64
3Ransomware...rna.py
windows10-1703-x64
3Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-08-2024 16:46
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware-master.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Ransomware-master/LICENSE
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
Ransomware-master/README.md
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
Ransomware-master/Ransomware
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
Ransomware-master/etc/Ransomware.Cerber.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
cerber.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
Ransomware-master/etc/Ransomware.Cryptowall.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
cryptowall.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
Ransomware-master/etc/Ransomware.Jigsaw.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
jigsaw.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
Ransomware-master/etc/Ransomware.Locky.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
Locky.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
Ransomware-master/etc/Ransomware.Mamba.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
131.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
Ransomware-master/etc/Ransomware.Matsnu.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
Ransomware-master/etc/Ransomware.Petrwrap.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
027cc450ef5f8c5f653329641ec1fed9.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
myguy.hta
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
Ransomware-master/etc/Ransomware.Petya.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
Ransomware-master/etc/Ransomware.Radamant.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
Ransomware-master/etc/Ransomware.Rex.zip
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
Ransomware-master/etc/Ransomware.Satana.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
Ransomware-master/etc/Ransomware.TeslaCrypt.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
Ransomware-master/etc/Ransomware.Vipasana.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
Ransomware-master/etc/Ransomware.WannaCry.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral27
Sample
Ransomware-master/etc/Ransomware.Wannacry_Plus.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
Ransomware-master/etc/Ransomware.library
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral29
Sample
Ransomware-master/etc/load.sh
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
Ransomware-master/test.py
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral31
Sample
Ransomware-master/test2.py
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral32
Sample
Ransomware-master/warna.py
Resource
win10-20240404-en
windows10-1703-x64
General
-
Target
Ransomware-master.zip
-
Size
12.9MB
-
MD5
30da61eabe92b48ce784f7ee31f5ec44
-
SHA1
4922cfc2c10b5d92b2fb199fc6a2aaed095035e0
-
SHA256
2e156957ffdc73801662b89b1f6773434c4d13bb4b9bc1670827e399ad64aa7e
-
SHA512
648a9e6ddce09e5bf5da680f8d031afe3224b236cea9598e64e0d592f64ec0bed61e0ff089a931772d0f758a42a463e7ee6ea7ef117ad1c1453dbc2240b9f209
-
SSDEEP
393216:67aFd62nfFSrjIkV4mu/GyBSKb+JYSWTmq:67aHnnNmkpbDSWD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133670908636533866" chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe Token: SeShutdownPrivilege 1120 chrome.exe Token: SeCreatePagefilePrivilege 1120 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe 1120 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1068 1120 chrome.exe 76 PID 1120 wrote to memory of 1068 1120 chrome.exe 76 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 2236 1120 chrome.exe 78 PID 1120 wrote to memory of 860 1120 chrome.exe 79 PID 1120 wrote to memory of 860 1120 chrome.exe 79 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80 PID 1120 wrote to memory of 3292 1120 chrome.exe 80
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ransomware-master.zip1⤵PID:4404
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff5df89758,0x7fff5df89768,0x7fff5df897782⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:22⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:12⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:12⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:82⤵PID:372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2532 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:12⤵PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4916 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:12⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2944 --field-trial-handle=1852,i,9360815511091658845,13872768842913985907,131072 /prefetch:12⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944B
MD5b44f4cb63a231b004fc3edcaf3bef43f
SHA1f1726f3b784e9293db8ba98d9d2d117b8f952a30
SHA25681055fe864bc319a4f3772a031dca523c795aef2567bf538edc0b343987c9247
SHA512be8ca3876c3ac8d2fef1eaec9bee130320f8c718ea0ab4f6958a18746cda99498f271725518e5965336908e1a93873ad20920e033c647938b4c0b84b61f71046
-
Filesize
371B
MD59a483630f51eaf27a7186adfe9a983df
SHA183d2d6534189c6baeb3f1d60c587d120d246c620
SHA256de260e16df9ddcb77c2fc28de4a5c19ed295d689b8f9ef41336e01376232e319
SHA512d12cd7a5d5be95e98e80db5dd4545026e240db8774fcbcf5a4d096b841025e44342ac21b47e037486fd80d1a11f02042005c626f555a117f6aa8430c342aaf3c
-
Filesize
6KB
MD5492d5b81dab47e2b2654007616741f6c
SHA19973c0c25f0860afec6588257927d74474e8e98a
SHA25639d4f26bd94fe95d97c0cdd3dffad085400497643afe38210378794ea6a827af
SHA5125d8fd525f64f59ff79649d264e33fd1a7b6aeda5881808bdc20115ea33d918d41f886b4c19735fcf9f80384dc4046c1bcae637dcbd16215c683d9bb52461a3f4
-
Filesize
6KB
MD5b6e6ffd96f117dcedfd14af3f5b67865
SHA1700eee6fcd81c505797e2464226712b27a6fdb1b
SHA2566b362ad40d08aca0a19387dbee4a19525468b3ca93298a1ab8b7ed6afe494636
SHA51230d970cfa8a7c7423ff189e670c10e891e68852563443cd260cc6eec9a3f83dcacf5464bc59437b7cd3506a899845f7895750cf460f68e2e4a0f859a07139633
-
Filesize
15KB
MD57974801450b07462882ffe03e5f78c9f
SHA154aeb612cad317def6a3a178ec795114b57b0ff7
SHA256b153a1dad164a9fd6d52d268c8caed02f92315cd1503bb590a28f55392cf63f1
SHA512f4a73e941680e019b073b4a2403b89652e1d7a7d7a99785a78bf7654818ca9f743b5d8e824a98fbb34a059191347756398886a22fe2aa09dc7856585883f44ca
-
Filesize
295KB
MD52712875cf466c80cf304bf1f02775031
SHA14af3939c8a18f181eb5dbdd768e6786df23a0f87
SHA256074a2a2ebf6b77be9dc37c1332232dc0ecfd35aa851b984cbf74433bb218ab9e
SHA5121a8fdf4976cce41e9dc3e1bbc50240550fc2bfb371a95dd4863eddefb304b82a7f0187fed56df7a291a9fa70d29b3437d8cd3d8fe28acf7c65507b485f1337af
-
Filesize
137KB
MD5398e4e678b2d297b871c975138fdfc93
SHA10d11925c32b52d83f089608af3d1b115208b62c9
SHA2561436351515a7c2bcd56bd219540fc3cfbd11ff488ac9749a983f8b59e70a637c
SHA5124bc99b39914ab39e45b40c45acd4a1a8802d5ae983f896be640654510ec2850fdeb82c29fdafbb06a6eeb1c72dee6d06da5f99b7118e27419a03a5835cab46de
-
Filesize
313KB
MD557190485bc7be95431d383f4108529d9
SHA1d826844d687f5d60f44706a4249901b4721af7b9
SHA2564463390dbb3b29647968a6d80b032863d1e0875ccf5927664cfb03210ba70a00
SHA512ca6d8e53b684583dbff61f1f0ed32b8d06f10d49bb953344a704140a670e4ad56c228643cca4cb8754b3d8d3fdb731e018fd4f13143cfb2f2d90e7255bd7a717
-
Filesize
294KB
MD55a31dd4d3b8ecd4c11cbfce8fd73b734
SHA1ea8178ae4582f8471b6134caeeaea189c46465b0
SHA25672ac8afe4e48592c7a43db2f6d1737c5d0458d31108022b9a26e0d4e7bceee59
SHA512e112e2f5a557e3bfb23b8977a694bfe9a8ad327a5c623c029d5abe71264c0e48c9de916456c07a761e1e5418b0e4dd6aa802e1be062dec094c0e5530fd53a5cb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd