d5b473bba1a201ebb4c72da1da032b5873a792d6c66d791fac515a94d3052691

Analysis

max time kernel
53s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e9648e3230c19394176.svg
Size

762B
MD5

7b3a37fa249a857b0ff136db0a73f44c
SHA1

31d00d4c6d14eaccc74ffccce60a242f3479df0e
SHA256

d5b473bba1a201ebb4c72da1da032b5873a792d6c66d791fac515a94d3052691
SHA512

543e7840e4b90c889e1741f7fff9f7f2db23ad5a7720a7cd687778f7da86923b1696293755423add6ec7a880ba4e4ee903d6da287b91d1c46b9602f8b865a4fc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f615422ea9c656668718da16ed3709955b57a3be59386e66ae2bbc0fe5924854000000000e80000000020000200000006ed6d65974b7d4b54f241823d0ca3823bdcb526226ff9f95e4c1a9aa4aa3cc1320000000bd6e0243ffbe73a3c3e4e28511de6c21240e99b77b858600fcdc063dcbaa934540000000a928a28f708d84c54eb3ce76bd8644440c45c901d5ded88a78012841cc4f6d8d12a2a3237d697a527ccfe0eedac9a6b45e9fdd0e38b444aab037d0b5505d7b03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000404e4d60084215228d0e03c8c402c03ea7b1b26a3889a29f372752e03dd9c244000000000e80000000020000200000004e7a2148e4220eb787cd1af41c27a37a8f3d1ba77a8cd102320ce6f7baa932d390000000b862778aca5aa55154597fa65133866666ad31fa5f227d99df72efbe2aa1fa9ff222bf7af9d849b8a3bbfc93b2a89dcb9fc2076239ecd880be1e4f55b70f4f0ec8e2ec5253a9325b31f10bf59e3934681c9f561ac6cc05f917bf24f5789955e7f5aa8ac3b07d28f20c413c4c101a8351f44fa333686208e8e36b3d333612f15d01f927174ef25c77593c2a31aa296f7c4000000021267dbad5b28c46fa29172c4150d3a9d095db132a92280bea01c0f08ea0389016d08499071ca8c0df1a17c134cbecab7089c2110dd58842c9d5a89e17c37182	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42BED0B1-5820-11EF-90E4-FA57F1690589} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400846172decda01	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
592	chrome.exe
592	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe
Token: SeShutdownPrivilege	592	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1680	iexplore.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe
592	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2932	1680	iexplore.exe	31
PID 1680 wrote to memory of 2932	1680	iexplore.exe	31
PID 1680 wrote to memory of 2932	1680	iexplore.exe	31
PID 1680 wrote to memory of 2932	1680	iexplore.exe	31
PID 592 wrote to memory of 532	592	chrome.exe	34
PID 592 wrote to memory of 532	592	chrome.exe	34
PID 592 wrote to memory of 532	592	chrome.exe	34
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2348	592	chrome.exe	36
PID 592 wrote to memory of 2088	592	chrome.exe	37
PID 592 wrote to memory of 2088	592	chrome.exe	37
PID 592 wrote to memory of 2088	592	chrome.exe	37
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38
PID 592 wrote to memory of 2164	592	chrome.exe	38

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e9648e3230c19394176.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67a9758,0x7fef67a9768,0x7fef67a9778
  2⤵
  PID:532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1020 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3364 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1504 --field-trial-handle=1244,i,4120949259691850661,7346113975828836098,131072 /prefetch:1
  2⤵
  PID:2988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2956

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5ac
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
361485b16da9a764543b87d429e690d5

SHA1
d8e08132e4513b45476ad1a9af10127b42496ff6

SHA256
eb1fa01f582a957188392b0d5595574feb9231f4a9d2383f5601ac60f3b79c8b

SHA512
fba4419aa6fce1f7b3b959e5d25dff1648cbefb852f6008b1aa884b01a8f62dc869f955d0d90d7fdb721d811ba696c3b38cb47546077a45524df40897abe8760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
201db7d393ec9a9b8d5b3f498e5bec40

SHA1
4e686c47d43f5dcedc3619b4bef6118c85efbab7

SHA256
e1b1641a89051e7773a46a53e303b5351ffaeda97a7556e4fd51d4955e8c0a43

SHA512
411bf6fd5b91e35c5a18293fce7212ee5f4ad8690e19172b2095dcfdbbcbe0b385de23ebcf5438bb251c9e4351d781657f062e4805ed30ac8de343d8472e1ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57101576314e70e6de00f4a532a8ab57

SHA1
edf2d775e44d07f50907f2159ed37a59d166f87c

SHA256
345b82fd4a1c70c700396e294b9c9664f0af81265cbb589d82b9e6a292bd3aac

SHA512
64d894b29b9dbab003f46f2fcf4b8a49c195bab61533100cb4928497d4ebfb5dbdcd086c7ffee5bce44e87cd4e993aa14ec5c218fb6d60f9629a731058d1f841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c6f40e874ec26494811c9c633214970

SHA1
387b982cfca2f8256e476de2fdd86d4cf2e14ac3

SHA256
b0b214faedbeee5b029ac0020558674edacea7f94b8deeca6081f0d8528752b2

SHA512
21bb3b132b06d49f49f31a483dcea4d9531fb83a456d33f6550625a3ae24908756b4596702f75bfc8fb5873095b620cc72b018eb84dfe9b46fd9d1ec22f1c873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d320ae8f0bf52249402a07a947dfe7

SHA1
e402977535376e6e2ce0f03863a136202ca9089b

SHA256
f06d5f07a736625ec2bc24bc9cb54ecb0a8c6cc91d909670bf545fcdc5b4d4cc

SHA512
43109065cca75556ff4449756fab226590a9d9b7b9d962f124b9914639367f2eeecb035da95137c1ac0cdb48f54b912ee33e2aee111e8320ebabcece10fcb292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb7d5e6820cafe9246aa7e716f4c65f6

SHA1
0b3a6baaf5dd71838f003527bdc19958c0c6dffa

SHA256
6b744f431dbdac4723a4440a597dc5972bb1f989c48e13425aef148a75dcd6cf

SHA512
b6701842d1167839cb43b72b562ed558685a03dac79379b3e3d2facb5adcaf8c7d93f8961f45ac950572d0f468356f552d8eab3c5325748ed1a6d8ef1bedfd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99b974a0837870a29138fce3c349ab07

SHA1
db451bcc724937ad464ef1961a11d0a4e760e36b

SHA256
18894056d946d3c3826990973e94e9fb37db902357a9abd1a3acf0d923b5a9b2

SHA512
53a5b1bfb9ec0928f71a6b4de0fd54c9d7374e5d259c1df6017c16a9b5ac89b780a083da59bbb0689d08ef15aca54464f43999f20e47d2ab711466e919f6879a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df0df688b1682d82df3c0402e764d797

SHA1
d54fe379a4e273d5cdd63f5b2c5a8e0218c8491e

SHA256
e6ae010eceb6e07d6b1d223d94c5f2d0ccd393a584ed41ba2a2fa8c1a9f43154

SHA512
8b2234ebeb41aa277216c6a0cbc0914c87936ad2aea48da956568bd35f76143863db8e59f0f1940d2a539e566929244c2082f6173171208cc53322cfb90937c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3b06fa8657f8899f1e5ce419ebbd89d

SHA1
93316a6fe1239845166933ad8439bfd265dafba8

SHA256
794f09739949e997703c93705de6ced73f10944737654458e9dc3c5f8be00cd7

SHA512
0e7ccac2221f2cbd9d31f3678cee2809390fb8a4a83aadd3e09905c7fcbb82da42e0812f3fc2cab0c196a9c3d5fca0833ff5aa6c0f4bc586c8aeef35744079a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
412c13c94d8a7b9581ff759bbb0b89b6

SHA1
ceea0b5254ad39d7bfc2a5d2381194eb3ec3142b

SHA256
53052cef6e1114a6d0117ab7d6425142e063d01d6f7266e0720adb6bab0262ef

SHA512
f4c166557f5e9ea9a94d880d00ef06f58a78c88587dadfe8552dc78075ada6432b3de0669be9eafeed4e7565e54384a50a2bf56c843eb0b71a4fc1af1ac98b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
892dccd7ca7563ca0f70a75719068584

SHA1
bdd67169b02f0a31c9bcdbda3e202d51b8831710

SHA256
70fcba2e1d771b751ede80b5658c15da745993c806863242b38a8f59e285019e

SHA512
83f311648502ff7b379f9b4a506d01fa8155fd22c0b2f5383ae13a686c71ebd7ca0dea0e2139eed65768b2768069d897b12d81fed15f23c4973df95f105fa5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35f17126de4042b2f3a062dd8fc3d13d

SHA1
af6d0da7df2bd5d8999e9d1f002acff073d728cc

SHA256
ea325540b9453cbb8c777a3600842aeeae7226ab6547fa56fc0b76ba2e279749

SHA512
c88b3b2188b4f91173e8531e78fb2023f4bb71ede9ff14ffe1f8c2b35218a40229d1cb640fa92a4319bff86f6f95b7acdccc01a38726aebba1e5ec056b37a141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b855abcc66fe9df66bae2f552e2e4a33

SHA1
c32ec74a1fbc6af111ad8d1b7f7f22932ed99c44

SHA256
64b84b362f5323d571d4b2ea1ae1073a4bfd65d57c1914922d755750f94c1787

SHA512
1c7e4aca9eff5cde50e1e3e1d83d11389a16cce4f8fcc6977dc9cd3149bdfa73a965228d3bf6a4cf2570acd7e6ac7846f6bc59c7cf3cf57114cc16cc450a2422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a548571c9313ea48617b33168be53841

SHA1
bee23be61c07c7ce1d3ea616b3cc384deb46fef2

SHA256
26b317c217ca3cdbe491958f425abea30bbf8ab4f1272dd8a3406f9d66d02598

SHA512
47e5b2ae9ce266a0b64afd81f26b34b262a9d1351b65f8957176e892cc9c19bf4e4f3804f761e940cf6ffc05f4121cf112695494cadf68dca7691a1f590275fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c6b7e131a50d133f6b237d54a5cfb51

SHA1
c7c23fc2a52f6ac668d5875ea00bab74481bf50e

SHA256
754f61b247485f334d9d4ac6fbba5744ded8e42fddc571fd03d500b2304d552f

SHA512
0e9efb8eb7be363935e16c5a27ad985fa0c93c2e604498d1e1ffaf74270e395e214716e5db426787f622da1fa94b32fdcfa2e99f9ea7172b9e96f207885a022f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa886ebfc19da0954577bc04582eb456

SHA1
0e776c2344aee766cb52823aa0ced886739b1e66

SHA256
752d40be6f2f1f1b91c4ec8d6209338146e3a56d8ece44912d1130f4d5f0fd1b

SHA512
e2a23336f22b146149357002b7edb41ae00e81ed0d2aaf13eb1e81320e00dfdbe04b76489f3740fa96d6c9bebd20c46b39c1d0027e5f96687a95ae5d6ba3e80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05b3763a5d391acda77cb62c89e476a0

SHA1
9e0716162d60c629044e2f53a095a72c92f7069f

SHA256
623ef4da3aafe2959f8769a50de82995f0103cd1ead5c4760eaaca46ca1a2cb9

SHA512
22cd9375cfe24b8c7ea10116ef0eb765bb6f6f28062f0a63fc711444bcff78d28caf8d719071cc01755d6511fe4b32d3bed343ee4d20ce9c98f7cdb60d12c049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c2dde03f62552c87c569c1642291517

SHA1
d1ff5b3850ed0926513d310f53ce49dbb16c137f

SHA256
83f204b8c85ac81b1292895b5d51038bcab0027d2f86bea888107818312ea4e2

SHA512
29e4a257ff339a61824ed0b331a98e0dcffec4a36b375c3b58cf30f28f36bcc206f5d95082bbc90fbfac0fc997175abe13338635542605fb9a3b2553f43681eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a93eabfb0f945f43fafba2d447e994c

SHA1
465a4eb2623f2dcd92ffc4185551aaf5bd9251c0

SHA256
1afca19f1953b537d4987ce8b5e4868d327260111d0453dca31b4ae789a59269

SHA512
e1db712bf7137e58d40fe4eed33d03f9b87316b038e7e60c4385bbeacf10206d3b49fc17c92b8fee9a7ab8374e95a7b3e61cd8202deae2fe4d380a4608f94d43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6c4d73001938e9de7a6cfc443272c920

SHA1
a1afa28b24d2c99a5eaac1bac63df9df3c68db95

SHA256
7386300d2f934c04fabf4eedeba5d3c7215374fe71c22c292547c05bad5760a9

SHA512
79afed0a3142d8bfe348a9690dda980bf2d79e068f49d27be108e69b72b14f0047c310f5184571cdbb243b860d969dba3792c43d60634ddc06aa2d83b3a56afa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
633B

MD5
97b4033712c053dbc2412772a536406d

SHA1
11d10bd3522f478e193fde51eda799da2c4949f4

SHA256
1bc30f772eb7eeaa276330395ee1b7a558debb529dd02fb59d556043ec48a28e

SHA512
21327cac6454a9f71752b4aade3138c1beb3bc3d808cd9277f0c7fe24e478885cc619ee73234b1dc739b407eb7f0d0b36baab50021f5217d90153fceb2de7a9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
7f942d3ea29afcf88e207ba19655fb80

SHA1
fd602fbebc7fa0e51553b182abd8f4a88b843e87

SHA256
ede4e1b7ee05b9df46335cd0c4e52f5ebaeba2d1f28609ab7880b64970b088e2

SHA512
d36646865783f6b7a28170660a780827cf8e8afcaecd03bcdccfa8bba76ae1a7d2545aca57f929e540ad4bb9f87d5b821ce2fc10da4a838016afa5666521fe82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
15cef75e02ba2ced398d06050c21d7a1

SHA1
34156435cc4b81280374df9c374af031ef48849a

SHA256
a0efab426eba85e42ed27114e9c36eb9503cbe4c81f160add9122a49882948b1

SHA512
0d98a9838b81cbfdb434a2e13e63eb24a8a2a6c2731c516b2e01b7dba4a3a9bdea5d243398563e473762c333407361af972aa76f4724ce1fcd2d1b515abdf98a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
53eefad2bc2b9733a9971b618092824d

SHA1
d78843e7de3240d3b8e8b1ba556f9fa17b8701ac

SHA256
154a144c1dc1e844f916fc1e6a4898a89f624b3a4f5dda4e0059f02010b51da4

SHA512
d7578eaf7b8d5611f1b107eb8bbf288e3c4c1c772719656321d5d69827bedc586aa5651812b5575454c62461be8c034ab430e42746258c568410e8127aa5bf3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
35b6b015e08b9079fdfd4e2b6f144b4c

SHA1
7ccecd37ffdf6ec84a29cd800f6197269cc472ce

SHA256
01bccce5305dfd34666558a09ae88ac5382ba02da3c36f929df69513b8240900

SHA512
dca96ad890586689f1e034f7dbac279da7b4bc590e85535c1117bba4a4172c83cfbedecdb6f4cf60900596fea13f21cd2165d13d177a8889133d8450e6e07ce2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab273.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit