Edit tour

Windows Analysis Report
http://103.23.144.53:15221/32A7E157.moe

Overview

General Information

Sample URL:	http://103.23.144.53:15221/32A7E157.moe
Analysis ID:	627102
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4880 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://103.23.144.53:15221/32A7E157.moe MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 3856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5180 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Snort Signatures

ET TROJAN NuggetPhantom Module Download Request - Source IP: 192.168.2.5 - Destination IP: 103.23.144.53

Timestamp:	192.168.2.5103.23.144.5349772152212031467 05/16/22-08:35:35.791973
SID:	2031467
Source Port:	49772
Destination Port:	15221
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 15221
Source: unknown	Network traffic detected: HTTP traffic on port 15221 -> 49772

Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53
Source: unknown	TCP traffic detected without corresponding DNS query: 103.23.144.53

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /32A7E157.moe HTTP/1.1Host: 103.23.144.53:15221Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: 32A7E157.moe_Zone.Identifier.4.dr	String found in binary or memory: http://103.23.144.53:15221/32A7E157.moe
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, 668a4275-2b7e-4a47-be81-d8f799746531.tmp.2.dr, 4eba943a-7318-4866-900a-b1280bbdc972.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://dns.google
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://r5---sn-4g5lznle.gvt1.com
Source: f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://103.23.144.53:15221/32A7E157.moe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5180 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5180 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	1 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Source	Detection	Scanner	Label	Link
http://103.23.144.53:15221/32A7E157.moe	2%	Virustotal		Browse
http://103.23.144.53:15221/32A7E157.moe	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4880_2039125835\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.203.109	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
clients2.google.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
103.23.144.53	unknown	Viet Nam	131349	DIGINET-AS-VNDigitaltelecomminicationservicejointstock	true
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	627102
Start date and time: 16/05/202208:34:18	2022-05-16 08:34:18 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://103.23.144.53:15221/32A7E157.moe
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.troj.win@29/118@2/6
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
http://103.23.144.53:15221/32A7E157.moe	true	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, 668a4275-2b7e-4a47-be81-d8f799746531.tmp.2.dr, 4eba943a-7318-4866-900a-b1280bbdc972.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false		high
https://clients2.googleusercontent.com	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false		high
https://apis.google.com	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	034a2cdb-b85a-4adf-aea6-46f695743969.tmp.2.dr, f6d19268-3c3b-47e8-9c10-928b58542d0c.tmp.2.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2022 08:35:35.488728046 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:35.490700006 CEST	49773	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:35.703779936 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:35.703938007 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:35.707593918 CEST	15221	49773	103.23.144.53	192.168.2.5
May 16, 2022 08:35:35.707751036 CEST	49773	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:35.791973114 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.089040995 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.089076996 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.089415073 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.089571953 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.089584112 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.137458086 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.138732910 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.138765097 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.138923883 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.176357985 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.176438093 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.176565886 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.180156946 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.184420109 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.184438944 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.184777021 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.184813976 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.185096025 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.185122967 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.185255051 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.186470032 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.186575890 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.238631964 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.239190102 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.239252090 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.240430117 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.240561008 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.353776932 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.353802919 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.353893042 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.354063034 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.354084969 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.354135990 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.523458004 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.523730040 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.524569035 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.524710894 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.525389910 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.525425911 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.525681973 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.525712967 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.558684111 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.558763981 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.558840990 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.558923006 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.566623926 CEST	49775	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:36.566652060 CEST	443	49775	216.58.215.238	192.168.2.5
May 16, 2022 08:35:36.569252968 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.569281101 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.569298029 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.569315910 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.569366932 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.569377899 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.569454908 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.570574999 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.570595026 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.570640087 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.570671082 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.570722103 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.575597048 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.575774908 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.575805902 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.578013897 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.578174114 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.590336084 CEST	49777	443	192.168.2.5	142.250.203.109
May 16, 2022 08:35:36.590377092 CEST	443	49777	142.250.203.109	192.168.2.5
May 16, 2022 08:35:36.784192085 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785520077 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785547018 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785564899 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785583019 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785600901 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785602093 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.785619020 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785636902 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785654068 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785656929 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.785674095 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785680056 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.785691977 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785708904 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.785711050 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785727978 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.785765886 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.787925959 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.787945986 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.787962914 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:36.787981987 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:36.788012981 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.001023054 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001049995 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001070023 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001094103 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001115084 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001136065 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001156092 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001163006 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.001177073 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001198053 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001214027 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.001219988 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001243114 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.001243114 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001265049 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001267910 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.001286030 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.001305103 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.002909899 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.002944946 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.002969027 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.002994061 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003021002 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003026009 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003041029 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003047943 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003062010 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003083944 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003098965 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003114939 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003129005 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003139019 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003151894 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003160954 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003181934 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003204107 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003206015 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003231049 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003251076 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003257036 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003278017 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003292084 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.003303051 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.003344059 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.216223955 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.216265917 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.216286898 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.216370106 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.216448069 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.769083023 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.769237995 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:37.984189034 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:35:37.984298944 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:47.274353027 CEST	49773	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:35:47.491374016 CEST	15221	49773	103.23.144.53	192.168.2.5
May 16, 2022 08:36:22.995225906 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:36:23.210191965 CEST	15221	49772	103.23.144.53	192.168.2.5
May 16, 2022 08:37:08.233788013 CEST	49772	15221	192.168.2.5	103.23.144.53
May 16, 2022 08:37:08.448461056 CEST	15221	49772	103.23.144.53	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2022 08:35:35.603950977 CEST	63712	53	192.168.2.5	8.8.8.8
May 16, 2022 08:35:35.630409956 CEST	53	63712	8.8.8.8	192.168.2.5
May 16, 2022 08:35:35.968245029 CEST	63187	53	192.168.2.5	8.8.8.8
May 16, 2022 08:35:35.994856119 CEST	53	63187	8.8.8.8	192.168.2.5
May 16, 2022 08:35:37.227375984 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.255465984 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.256028891 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.284311056 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.284337044 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.284352064 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.284368992 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.284728050 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.286525011 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.357939959 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.359134912 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.386534929 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.396680117 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.400644064 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.401360989 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.402030945 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.402409077 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.411043882 CEST	443	60971	216.58.215.238	192.168.2.5
May 16, 2022 08:35:37.429495096 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:37.451978922 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:52.395234108 CEST	60971	443	192.168.2.5	216.58.215.238
May 16, 2022 08:35:52.436465025 CEST	443	60971	216.58.215.238	192.168.2.5

Timestamp	kBytes transferred	Direction	Data
May 16, 2022 08:35:35.791973114 CEST	1131	OUT	GET /32A7E157.moe HTTP/1.1 Host: 103.23.144.53:15221 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 16, 2022 08:35:36.138732910 CEST	1142	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: mORMot (Windows) Microsoft-HTTPAPI/2.0 X-Powered-By: mORMot 1.18 synopse.info Accept-Encoding: gzip Date: Mon, 16 May 2022 06:34:36 GMT Content-Length: 85790 Data Raw: 0e 19 72 69 62 45 3c 2f 46 0c e9 e4 76 cc 30 1b 9e b5 87 51 b0 93 14 2e 1b b8 ac 37 e6 80 d3 cb 0b ae 0e 5c d9 86 82 f2 b4 8d 09 cc 40 78 b5 24 07 05 3a cb ec c8 09 0a ac d9 b2 56 f5 87 ca 21 1c 27 27 2a 05 2c 72 59 dd d3 eb 2c 15 2b 75 95 69 9e 68 9e 5a f1 1f 5c b0 06 3d de de bf 7f 31 de ff 64 2f 29 06 7b ab bc 90 14 8c a6 19 04 e2 e9 97 79 94 7e f3 ad 64 af 51 e2 06 8a c0 fa 1a 08 81 f2 ee f9 6f a9 d2 cb da 13 d7 60 2c ba 7e c6 20 9a b7 27 13 a8 b1 8a fa c9 f2 8e 66 4a f3 57 49 1b 23 5b 84 11 d6 72 1a 25 98 4e 67 f6 39 95 e2 08 ae 47 0f 96 6a c0 12 c2 5d d7 d3 54 51 86 3c 74 48 b2 cb 97 e6 89 25 49 93 5e 1f 39 53 39 bc 17 04 ce 21 99 35 0b ef a8 75 ae bb 92 57 91 1f 97 15 f1 30 f1 b0 7d fb 76 94 9e 6a 93 64 d6 61 52 f7 85 45 72 1d de 94 34 97 c1 ca c1 28 89 71 9d 16 4a 22 73 ed 63 b4 21 5a 99 a0 23 ca aa 97 4e e9 95 e0 f5 33 45 26 7d 3a 54 12 f9 a7 ef 98 f6 32 37 e7 90 94 5d 87 bb 07 57 3a fd bc 95 e2 0d 46 f7 cd d1 86 4c c4 c8 0b 40 a8 af ab a4 a5 1f 22 31 0d f3 87 f4 54 c1 e3 2a bc 0a 53 08 3d 4a db 29 24 20 7c dc cb e6 4c 4b 40 67 37 07 55 42 6b 54 13 81 ae 4a a2 67 7c 56 8f 06 f4 02 b5 2b 67 26 af 0b c5 44 2d 60 32 b8 45 c1 5d 02 b1 49 db b7 b4 d9 bc 8a b3 67 13 f0 d5 5e 80 87 87 28 02 98 77 b2 45 8e f0 11 7d f5 c5 af 7e 97 4d dd 54 3e f5 d3 82 57 ef b4 a2 a7 1e 65 45 9e a7 dc 08 d4 71 97 4f 5a 46 3f b8 07 8b fc 35 53 16 81 ca 60 08 3d 01 05 ff 7b bf 06 77 a6 0f 3f 6e a9 f1 2b ae 12 14 b1 83 27 94 a2 23 3e 34 41 2c dd 30 7e e4 1c 61 87 b9 97 77 7f b2 83 17 77 e6 c8 5d 63 48 8a 92 dd f1 cd 37 f7 f2 e1 1c a8 91 3b 4c 7d 29 2a 11 1a 41 f2 cd 27 e3 70 d5 5a db a5 b4 95 d8 68 2c 80 5e 8c ed b6 67 da 29 a7 a3 55 af 96 0c 61 e2 bc 0c 2d e1 29 13 16 10 72 80 c6 31 24 8c c2 70 e3 29 73 14 b6 e6 2e 88 3d 43 ea ef f4 9b 0d ee 3c 89 b7 53 ce 50 95 ff 65 42 15 01 d0 44 3d 48 f0 a8 5c 1c 0d 15 3b 20 fe 07 dd cd fe 3b b1 43 35 75 2f 79 cc f1 e6 fa 69 7a 0d 6d 84 70 16 0c c7 17 0c a0 f9 89 73 9f 4b 1a 9e 74 0a a7 b6 41 c7 4a b3 2a 86 5b 2f c8 15 74 3b 37 11 f6 e3 ec 3f 3b 67 98 cf 36 cd f9 e5 87 8c 06 38 70 7f e3 ee 2c 43 e2 63 3f 40 7c f2 cb 38 b4 a1 5e fd db 2d 81 d6 38 89 32 c4 73 f6 11 60 ee 95 2d bd 26 a9 e8 09 23 4f f2 cf 23 07 95 c4 b1 ba ae b1 a1 2a e5 6a 33 69 35 d5 89 e7 8b 9f 69 3a c2 10 ab 3e 12 50 52 59 c1 8b 4d dc 56 18 27 de bd bf 8f ea 56 d5 79 bc d0 da e1 86 38 95 15 dd f1 a9 e9 14 01 76 05 d4 2a 39 f5 df 88 9f 47 f8 ec 58 ad 11 e3 ed e8 e3 23 89 a2 47 de bc b1 e9 94 b0 39 fb 14 6b 4f 95 08 70 2c fc 1f 1b 16 5d ed 5c 3a 2e 78 bf 35 9f fc 17 4d f1 70 3b df fa 37 f4 8f d0 1f fd d1 ee 7e 17 30 f6 e9 45 b9 35 7e 52 cb 61 c4 e0 44 9f b8 7a 47 82 da ee 29 64 cc 2e 41 d3 6f 58 cb 2f de 59 7a 70 6e 98 02 69 9c 93 21 75 78 1d 8a d0 89 cf ce 24 7c 07 fb ab f1 53 2a d6 f2 0a f0 8d fc fd 2c c8 9a df 5c 82 1c d3 32 ce 1b 4d db 4d 54 f0 17 99 1d 53 10 30 c2 f4 3f a3 64 4b 29 20 0e a0 47 58 21 6d cd 4d 5a 0e 7f e9 c9 ba 7d 0f 14 fe 9b ee fd 58 55 5b cb 60 88 48 1a 62 09 e4 9c dc 24 7a 82 1c e6 ad 19 19 04 f2 35 89 fb 1b 18 e3 3c 68 44 9f e6 38 b2 cf 25 68 f0 bc de 0b 89 e4 22 cd 91 45 32 01 30 13 ac 3c 61 cf 57 c6 9a 63 7d da 56 ee 13 e7 ad ed 0e 36 47 4c cf 48 f1 ad 1c f3 01 e8 c2 d9 59 86 40 e5 e8 04 46 4d 7e 3d 56 a5 13 96 f7 0f aa 70 48 e9 42 96 47 2a c3 2b de df ed c1 02 78 2b 5b 67 f9 ec 1d ef 72 3c 8f 5d 67 b8 47 9c 78 8c 64 af ad 25 f4 ea 0d fc 95 86 f9 ff f3 e2 Data Ascii: ribE</Fv0Q.7\@x$:V!'',rY,+uihZ\=1d/){y~dQo`,~ 'fJWI#[r%Ng9Gj]TQ<tH%I^9S9!5uW0}vjdaREr4(qJ"sc!Z#N3E&}:T27]W:FL@"1TS=J)$ \|LK@g7UBkTJg\|V+g&D-`2E]Ig^(wE}~MT>WeEqOZF?5S`={w?n+'#>4A,0~aww]cH7;L})A'pZh,^g)Ua-)r1$p)s.=C<SPeBD=H\; ;C5u/yizmpsKtAJ[/t;7?;g68p,Cc?@\|8^-82s`-&#O#j3i5i:>PRYMV'Vy8v9GX#G9kOp,]\:.x5Mp;7~0E5~RaDzG)d.AoX/Yzpni!ux$\|S,\2MMTS0?dK) GX!mMZ}XU[`Hb$z5<hD8%h"E20<aWc}V6GLHY@FM~=VpHBG+x+[gr<]gGxd%

Timestamp	kBytes transferred	Direction	Data
2022-05-16 06:35:36 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-16 06:35:36 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-05-16 06:35:36 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 16 May 2022 06:35:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-MVyMHaQWvpslKVVNalUYow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-MVyMHaQWvpslKVVNalUYow' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-16 06:35:36 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-16 06:35:36 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-16 06:35:36 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-16 06:35:36 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-ztAWPqnhco5q7nze4L4_Qg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 16 May 2022 06:35:36 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5613 X-Daystart: 84936 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-16 06:35:36 UTC	2	IN	Data Raw: 33 36 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 31 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 38 34 39 33 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5613" elapsed_seconds="84936"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-16 06:35:36 UTC	2	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-05-16 06:35:36 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:35:28
Start date:	16/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://103.23.144.53:15221/32A7E157.moe
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	08:35:31
Start date:	16/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	4
Start time:	08:35:38
Start date:	16/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,10999688318188569781,16230177679758669415,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5180 /prefetch:8
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://103.23.144.53:15221/32A7E157.moe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\26733cd8-5f26-42de-96dd-db2015b8d882.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4215023a-e186-44ca-9fe6-c964fcd1ad3c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\474cb7c8-c9ed-4f21-b9cb-ccc6c588ed9c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\9d39ad79-6390-44ba-9eb9-950ee47d9696.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\034a2cdb-b85a-4adf-aea6-46f695743969.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\53669d0a-3bdf-4737-85e3-31e034932b40.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\MANIFEST-000001

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\668a4275-2b7e-4a47-be81-d8f799746531.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\4eba943a-7318-4866-900a-b1280bbdc972.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a95cd64d-1021-47fe-bbbf-f1bc6aafca3a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\af15c723-19ae-4c47-816e-1baf473a60b2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b06d649c-5571-49a0-af03-f4deb6ecf986.tmp

Windows Analysis Report
http://103.23.144.53:15221/32A7E157.moe

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre