njrat | 1d3f0c9127f4a577a23e94e1271980464d7be9a5888976a29c219f1295831e38

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload.exe
Size

55KB
MD5

4e465a6ec07921dfb8001c62240b6046
SHA1

1f720089177be34e2e764c412753cba824805626
SHA256

1d3f0c9127f4a577a23e94e1271980464d7be9a5888976a29c219f1295831e38
SHA512

40f967d735f6860f3103e85b629d799329e1651b6f7da55e6dbe7d96fa5c188625057e723ac8ed83993ee0f0610bfcc72f260c493633f48af15891286432efd7
SSDEEP

768:mda6lOt1Man8E2N6FikUt34okSNomwFvfu0YMDHPsIL7XJSxI3pmnm:md1cDnCN6FikSJDNwsNMDTXExI3pmnm

Score

10^/10

njrat discovery trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Payload.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133756305169162061"	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

chrome.exePayload.exe

pid	Process
2324	chrome.exe
2324	chrome.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe
4800	Payload.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

chrome.exe

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Payload.exeAUDIODG.EXEchrome.exe

description	pid	Process
Token: SeDebugPrivilege	4800	Payload.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: 33	2284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2284	AUDIODG.EXE
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: 33	4800	Payload.exe
Token: SeIncBasePriorityPrivilege	4800	Payload.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe
Token: SeCreatePagefilePrivilege	2324	chrome.exe
Token: SeShutdownPrivilege	2324	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	Process
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe
2324	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 2324 wrote to memory of 3884	2324	chrome.exe	104
PID 2324 wrote to memory of 3884	2324	chrome.exe	104
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 2372	2324	chrome.exe	105
PID 2324 wrote to memory of 4888	2324	chrome.exe	106
PID 2324 wrote to memory of 4888	2324	chrome.exe	106
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107
PID 2324 wrote to memory of 1800	2324	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffffd37cc40,0x7ffffd37cc4c,0x7ffffd37cc58
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4584,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3136,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4936,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5056,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5220,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4440,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5244,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4464,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5312,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4748,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5740,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5716,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5364,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5688,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5756,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3708,i,16327486595200788007,4792787501046073065,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2524

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
1fd2bcf7be677e004a5421b78e261340

SHA1
4e5abd04329ee1ffaebe9c04b67deef17f89ff84

SHA256
f539c848f584add20b43d5daefd614526b67adbf22b0c89eaa7802a8a653cd31

SHA512
929499946e38281bd808b37b362c4a86f3b6382eb1ecd5fc094410d3688906d14a114ca930a2cf38b6241ab734bc5959e6fe541270d47ca9538e82a68c99cc77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
436cf15283e16d8ad49ee4294fa1878f

SHA1
af053e35af283df70cf22946cb8154b18926a024

SHA256
b29b08228574ef943509b0db1f28dede62c90d27425d029b09909c9d28481c79

SHA512
da16c41cd951de52a00698dbf3d621ee095061ce561b2be0b9c35ea08be0e76e5ce4952bc8293995d74f3b4767f1c33391f58b1a3c374ba139f1d165fc825d10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
867ba70326a6141aedf986487fe47b7a

SHA1
ce8f4a27f9511dde449130784c311d85e7353c76

SHA256
28081cfcf8d2511c1c91aa00540baea9286875786cafe5fe0ea3a64787c7f34a

SHA512
baf1132e7db37ed7e1d1cedbe42b5efe627d6f3c96653c97d142716ea13c09623cb29272d3d5b7d34f4d5ae2f9443b15f3d915f1d8a3e942e9f64346d4026c02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
57b7971578bfc51afaf13e55cb6a4499

SHA1
92a2a81f38b1baf7aebf31f3503064edd2aa12cb

SHA256
3fc1121367e7cc9e63a7eda86fd256824dc7cfed45f5cfa48f3df2908a9e5f5e

SHA512
f02c4a34d0f1757d6bdd55f26e3b404415fc859021042a4a86eedffa427d540e43cd9ce5dc8f353a9eed0b81dc07cabb4e8e385aa4d4aa6a6df6a9e634007c4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
63104b313e66ded6013a0a1a4752974a

SHA1
f4207d706607715a2968e84453e316795fc2fc68

SHA256
45de346cb823b2c371b9df5e2a41f245f9a0f1656359045cf96c47fdbe4896e4

SHA512
92a90f66e1cbec91b026e1ec2b3b6ff327c6284b5173236470f5b2030fecf2b5808743d62174d1ab295035e1632d4fae606eefc349bc5cac3f036c894cf7c610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ca94dd4bcd263ca01596afd9689447c5

SHA1
055784f73f991a492162ea76c6d47351ea9f0ac1

SHA256
deb69d932676124440ba90b2d4e54aff8777c67d583cb10da0fddf1661fbbf16

SHA512
3259361c3a2f607de9e75fa437bb004452bbdd7bf83446de940a5b85cfb475fa51eb305fab86c0c2c3d9973b28150f5f2ee7059361b10e57cdae9a7ae5849d35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
33097c47b3ffc6e20d3d4d84f3598f4e

SHA1
ae7c455dc043af533e596092fb77e52445fe5c3f

SHA256
973a2733eedb653a6dc08584ad02b9b9be525ff16dfe2ce8d45e62d3c2d2a35d

SHA512
3eefcab4a8e91cac2579b2bd54772a6ba79112199233d06a5ef964bdecba7f1e2334cfc212c7fd334555c6c52b279cb3b00ffe187a1c1de6b9ba7b5575136077

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5c01eaccb63e6fc605d65f5b3f81f400

SHA1
bcdc05461f9fb253d69fa903b26522eb93fa0cf9

SHA256
41b4e7f514d88a0a135d447485c82759f836f4515665008dc0d2921ea495024d

SHA512
9d5ebcaeab182e9fa571a3c4a498972a7bb20986e4c95a9cc09171e62913c833abc85ad631e7333a96e386b10a5e60f88a90f90be48b2c9ce3ce05734791a63b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0e0127e448248cb29f5eb82fdd155cde

SHA1
48341cba422aa895d9af602ba90bf7db8b1016bc

SHA256
a18bd5475b31ef9a6166e65b100361914dc0a679878790b2d69eb24b508ea633

SHA512
48e5da9be1b342dd67309d4807bb14f696d494f36944aca521eaeb316a61bdb02eb7a688249e59c94c36499ebf4cc26a96053144451d220e03896062f25d198d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f2a3b310741ada392cb728f55e5903d9

SHA1
5dab03973646876c19764086b504b408cf456102

SHA256
42a1e654e00486fcffb2b6bd5c7c4d48fca0e9bceb2e80ab288650da6b88b69e

SHA512
3f1b6fa20856448832367b75690305e7b7fa561d5c834fe391b62e50e561ed1cf0d206992b53fdff4ad0305fc09a4fe37e7e58666f78c8bd51802df3c8b00433

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
a08869116bb6657342dba41c4e470eb8

SHA1
ec8d66ebb9c06773664e69996e7bb1dd60ea3a77

SHA256
509785cfd19cc05ca28e65764cd5c2fe15eec9b7d6aa9f8a2fd4f46898cc3858

SHA512
f311fe0c363dff3d97e221e5f1a07e51b9cd9a3da5ab5f76e1aae2d6d397ae8d26018c1ad6c092b61c9e1f61dc1bdd106e8ecec35a8b5061727764cb34064e52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5c48e3c63efe5b21e96e48c2e4e76c94

SHA1
efa642cf546544306da8b1eb1b52b8a9aa60e5e8

SHA256
0c9b98d155ce0fa024527af4db810b048fc360705ad1094e87ba5a06f6aa8682

SHA512
2e297c9478be030333ea9bda841bb966a954c301827d1b36d864e8eb426cb647fb642e392bba4d780a68ce7a2a997d687ecc282ff9eb0c8ea43c35977f23e3bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
19764ca9d9321b213bc2c6e43a1e67e9

SHA1
7a071d3785e3ab0534390b16aa4a3eeb038aab49

SHA256
cf4a2cff85af0ecd635f17f3e267a4faa88fb3de6e33e5486050d995114036cf

SHA512
46ab03928c2ab2191cd0fb05a804f5dfe08bedf024a771385e88df9fa8a4ef4c9e7a124662a984ccb942504b70a36f300342bc5e4229986d334c25243c796d32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
ef46935befc8a0670d41253dfd67a1b3

SHA1
b8ec0fdb32587870bc196195acbbd0c8cd8bcc3c

SHA256
4548896aeedbb197bc4cbe589f63cb9aa688a2d4fb29be82e690cdd47b19217e

SHA512
8c6f3db95a443edcf08bffe5b827e8e1042e2335635e4765dee7980064028feabfa4150b69b1b7c5af6e499a7e7a9f9ec7aedd299b0967fedc563d71cfbbd23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2324_469380840\8d833f75-cfad-496c-b74f-8bc83516d99d.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2324_469380840\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
\??\pipe\crashpad_2324_UOEWPWIVZPYOCYSX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4800-0-0x0000000074DC2000-0x0000000074DC3000-memory.dmp

Filesize
4KB

Download
memory/4800-468-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-6-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-483-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-5-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-4-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-7-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-3-0x0000000074DC2000-0x0000000074DC3000-memory.dmp

Filesize
4KB

Download
memory/4800-2-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download
memory/4800-1-0x0000000074DC0000-0x0000000075371000-memory.dmp

Filesize
5.7MB

Download