b48997a06687cbe6dadae5ab45884feadd5921f5fe6f79df810c492557669406

Resubmissions

04/09/2024, 17:35

240904-v5363avhmf 3

04/09/2024, 17:32

240904-v4je9svhlb 3

04/09/2024, 17:29

240904-v2thfstgmn 3

Analysis

max time kernel
62s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TotallyNotAimmyV2.exe
Size

139KB
MD5

3d729e9b4df34ddb7ddafe78a01b71eb
SHA1

2f01d3349288f33a5e50c1d779b27ea65f753249
SHA256

b48997a06687cbe6dadae5ab45884feadd5921f5fe6f79df810c492557669406
SHA512

bb476a263e2f29628801826c4f5869424133f26921262a98d399240cc6701519ad7337875adb2fa37f7dec122ec832195d0ea6216022646f61fc735528be5875
SSDEEP

3072:ZiS4omp03WQthI/US3BZC0EiRQ1G78IVn2tbSkcJB8ltt:ZiS4ompBUS3BZC0C1G78IVEcnct

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	chrome.exe
2696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2780	2696	chrome.exe	32
PID 2696 wrote to memory of 2780	2696	chrome.exe	32
PID 2696 wrote to memory of 2780	2696	chrome.exe	32
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2824	2696	chrome.exe	34
PID 2696 wrote to memory of 2552	2696	chrome.exe	35
PID 2696 wrote to memory of 2552	2696	chrome.exe	35
PID 2696 wrote to memory of 2552	2696	chrome.exe	35
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36
PID 2696 wrote to memory of 2568	2696	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\TotallyNotAimmyV2.exe
"C:\Users\Admin\AppData\Local\Temp\TotallyNotAimmyV2.exe"
1⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72b9758,0x7fef72b9768,0x7fef72b9778
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:2
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2220 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3280 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3696 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1524 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3444 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3488 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1188 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2236 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2256 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3816 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1276 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=580 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3748 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4140 --field-trial-handle=1140,i,13518076271545889255,7174826926736232783,131072 /prefetch:8
  2⤵
  PID:772

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2868

C:\Windows\system32\SndVol.exe
SndVol.exe -f 45810842 15402
1⤵
PID:2096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4dc
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db89b4bf1d99dc0ba5279bc42e610f56

SHA1
1e528c32418ee896e2cfc55caa5034ce04378c1c

SHA256
bd1d02c8105c8ae064558eda577236e41a67931b3094641895a61f39a7a776e8

SHA512
3884b385aaf07646cc0c3f028a6e21a1170faad8096f3cb8155112af20f38b6a599d426e9e3c9d7a87e41eb743c5eec1ff12264c62642b0c0f0af80e5f4af692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cefd6b8b9693f835bda45c05be642a37

SHA1
bf1730b6bae1bd6f058d1f7263be704372136ab4

SHA256
a78c92347378266c3442e856da8d0c3002e947863050edca526bd228bf440b75

SHA512
7343250fe551c49b4eedfb733732be961f6a1c1cf6cc7f457306443dd0426b0c065a9de0930baf1e8c9ad6b61b34c61b2e6653269b282c10959372b00b9720f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aae9e9b04af0febc9b400ff3c135ee0b

SHA1
3d5c2889396334870fcc09d835e05defb860b8af

SHA256
bf1b5241494a43dd41a8e8b6d7b06460fa5c1a90d0a2f85f14300631bc9cf6a3

SHA512
67a3b92afc3c8567d245964d7e434d991bb56f65bb2d32925079592228d5d8dc56577d5a2452ba3fe5b0e39ef8d082217c276d3e5545eccc9ebd74ebb640592d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5990620c002311fc32db6b45f838f974

SHA1
9cb664e788cb190fa07ef25571e50971424e5337

SHA256
b5673c9f8a30ce53147c9082c95c213950a6b68cdd4501fd59402159aa5465e6

SHA512
f2ac68be96cc652dbaacb227b9613f6a1f73800a0c25ddd0c2fd2be118082b156cef4cc131eb8015bcfaa8ff4e614df30acd00535deeadcfda328ed6b00af370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4308ce456f7bb2f4dcdf4d1ef74debca

SHA1
d408c72dc42983b0633e56567fbad9353bd446a5

SHA256
b61570de1895f38f719e2531ddf5df781b5b6ddce2efd476ef27636ad97ff4ea

SHA512
c2df76c88738b2eabd31f1c36affee1752ca9ec83ecedd88e00b7527d8a4235a855b3e61dbf6be3551d98d5eb6685447b7bada3e4b3aac62ce17d9561d2341de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749a58d2724a7ac106e58225990fad88

SHA1
ea283950d42364b9685735405414d013256f7bad

SHA256
60b541fa74856bbc5f3f22de5db6bcb8cbf9966c9e2446a6ef1f2288a428ccae

SHA512
7648c3d730e441dc8967caf2e3ff1eb3dba7b1e9614e339c70c7189938d5521df764bc4332d1ed02a6ec1c9760fae784b19ebb9e8a156231089e0c78cc970718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
708b8ce4da3e3202a727d5dd7982491f

SHA1
c60d12261e070dd9ecc7f347b3ad17b50e1d34de

SHA256
3adb079521fab2cc3dd70f3d90e8cecc22aa66d15f67067d36199373b3d50d8d

SHA512
128b520c45066b0cae3ce6a796b560b5630ba443ef5686a4cbb87d0433fea4c8ee564b38cad199f996cb8487e0822555f63bf4a6a3a8685596c46d74146cf41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71f98bc8a90efaec6e03ec092ef7239e

SHA1
3414d91be549a47a63c98fdc43b61958c5d716a9

SHA256
1865cd778b737b4381964460a5d259dd529735248ae01ede33e361c01c457679

SHA512
e83c254a75a0620eb478e9345269ece6c626e9985d7e7d28c84d7c054b4bc6fba515c19e26378f7c01707d3f6535e95ec014aa43441ca9fad053433fb2c0ecb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
bfe992368e59e5fe2abd58fb0e59d373

SHA1
ef3124f7a1a55f058b542587132033c8d99c721d

SHA256
a7e0aa04f6947aa09eacd99debbeead21488e792bceead7c613a99afe3049dc3

SHA512
1b377c2e015ed79483ae96580b8a92f28cc98d76563b8bd959fa8591937de1f8c4547dcca2c904927f72546430dc66464f5f50938573f1cace10739ba387da37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
aeea7739d113456a4f50d3ce4bb82ff1

SHA1
ccc97aa0a7244da23c664b7c4f34be677e559ac4

SHA256
e2e7ed84a14ab5634c04a0b49ca358813540a7d9018e8079ac093f35670e7549

SHA512
c0272361b0d668359c4efc5d7a771bdc84a094503269ff5484a0a07fed1a9c6c0014d603b51e54b7d0adcf74690ed4676e0fd9db25b70aa025bc256679aab7f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\CURRENT~RFf78f7b7.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
dc06da25864c995529d0162acb049078

SHA1
c41676527ca8e4dd2f14b1c967f467f200e6a289

SHA256
14830cc1fc2d2a47f366706dc4e14d2eb5bb8baccb3d5dfada9bf21685f63436

SHA512
e2ed7c2bd289edf32c85c9b9604fc90172ca9177b9d02d12d0442c3c7327ded7fa36860bcb2565ee28939e359ac8078d34157a4d59c283871c0ad0b4259633ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
6a617d2f25365556066eb9a80a72aa57

SHA1
29fade8db8b51b24d04121a158f5b198abdea1c3

SHA256
c13112d26f369042674f3bb407496585c3cedf676bf8d5bc25bdd82e4dab8159

SHA512
abad8092e5b2efef69d9013d41a80b3f21c3b8fe262b6e101125e5063a01375555b1a5fb3b7fd1d4bd6ba2655de44800abb1fbd11b8597842859878029c8006c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
520B

MD5
5f919342f3f10a839c4bf223d8a26861

SHA1
1d77c2c9590a71b53114c07fa49de54ede9660c0

SHA256
99feb0fd94101b834afe8796075fe1fce0ceb252aebe5a98afeb439b1d749e24

SHA512
b3e86a52d0dec5bdf63660f3f5057a7b49c75154db8992c885a9d53bf8c774d4b916fe09f139b871a50a100acf3e3875c81d92a5f28da38f0478b9afe9d962e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
359B

MD5
3ccf48040210b356ed4e6f02678e0456

SHA1
6012771c776d6d0c3b0092f24f4e11927dacc8d8

SHA256
5dc349c606300eb9a0739e8d17e97e8626e2a2ec11024441c3d2e7425296cfaf

SHA512
a06d222dbb6f2035f2a5ccec515c4711fc382ec8bf6035b7e8c8f3bde69ad02493cf3070c4db174a463b9b8a37bd803adcef47f76d1bdd4d6a82370b5c736fae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
adde9162d892fb8dee25e9f9eea55e25

SHA1
6a3735dfccc76244a36dd9d832d99e62d1bfedd4

SHA256
258b2026d73c57fa6b4bfe8b751e87e7bf3f629af6cb2667680d33f40da5ef60

SHA512
aeb9d19dd251750ee976c07d2ed739973f0cf92595d5ff1af8efa7dbfd83361abd9f5f9f0b86f2d5a14cfc91ec38f64ba279f937cb2af72ae161d6a738743286

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
bebe57a093f4d1957e66121244ee2b2f

SHA1
62f4c44c45a36215aabd68073909aa4ab66d179f

SHA256
c5728485ab5a064778afdf93d0defcfabde0ee063f8b4e106c9d8494fbffef78

SHA512
c8d2784976f705178609a05fc16e5278d12baa4e687f80b1c9065debc78f78555f23fdffbe43e35982b32b3ec7cce0f9edac01fc9175791f0ea7d5f71b51ed22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
16a5d1df274af46c8a6fcfd4b354cc33

SHA1
895248c8dd8f59b30f7a338a92cd9c63ced340c6

SHA256
928c04821fb228584aca0977814980545678dea7c82d751f3cbb8ed13f3540ac

SHA512
3970e92e938d1558cd3e9fa77113c6e8186e523e6b97cea967d0b5ebca6375d2d007efe58ba6977ce6e263a8ede6916c84ea8f33312e5eff0f7d9c891fa253a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f3e6ce04b507916ac4626ba1bbe62c6c

SHA1
484b93dea2ec6d3bd3f1fc41e9f66f698f14028d

SHA256
13820326320e0049c70bd463c17bec57281c7d9a92fd866d978861973af256f4

SHA512
f3fa6dfc79829db2c22b76830e3b05af5252407f0fac04487dabac75bc5dbf4722d93ba65aee490ca42bc91ea7a3e5de05c26934e73340d204b4db63a0da0ade

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f3656ee5d98876608bb525a15c774c40

SHA1
494cf9a336a86be194f8b14564cefc37fafd3abb

SHA256
fcf0463f04c1e4f1fa0666bc0f090a89f1e797dac6f0bff45402e1f9e7f7becf

SHA512
4603c342183d5b60fa492f9af416b4cee96429f6bde3b44b210e1342f41e50a7e2a13429ac9ee891c39291eb487b30ea26f498353678f365cbca34ef338843f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5f87b32818075598db189d7b50f5cc44

SHA1
3a87fa84d5b80a865d12babb76ec529979006ab1

SHA256
290bb1693d9db844651ef066461f57d9452cb6080555177000a22c4af7518fe8

SHA512
28a63aef6b2871c620dc6cf65ccb9d6db8398badb4fcf0bb135e4f129b99b258eedfa47b3ea89d4d5dfbf11ce0e79a35c51a366f566aebc7325382aa4aacc91a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
26382b4c4315698f36648dfa5ece5b4e

SHA1
d93b014c2d64ef57e7cb156c242f78fc355b2cab

SHA256
a5cc0552179d3b917edd7ab6c23713cc2a36d7ba5c36844eeedf6640512ff5fd

SHA512
3c558b62daa560a0eb2a92d3b06a1de7bb84538618502ad612dbccbceccf06848fa6f3c5065a397018ef30781e7104f107903f6c056e7eb6850ebbccacca88a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
335KB

MD5
4aec68a0728b47dd9d049897a395bae4

SHA1
e0f03cf2a5f74da355045eafe9a6bbe5941bff94

SHA256
4e92fafa59053f332681c0e411645bca69a91d2ed92b88b7b64155445e51d72b

SHA512
991078a7a2950bc1557079dbf57070d99750cf7c450195f6035fd9977a8077df799fcb4f496c609d7670e5c69992962524252090b9648fa9c16c4aa902f7bf63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
335KB

MD5
4ffb90981c2a3df2d297e751e88a86f6

SHA1
4830d31e9a4fa6c129727ded46e2108e1d1d4fea

SHA256
64587a6508947aff67165a70c7ef8fab3301fe939d98de7c5d1d4ce2639b8d97

SHA512
4e04cf67cf72b826714862310ee687511181b5b1e8aa5afe54133e8346852af481db1fd31e072bc7162f7c2a2784ba19519db5a346979613edb2e6452ec8ab58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54F8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2096-541-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download