Analysis
-
max time kernel
600s -
max time network
498s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2023, 14:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u33086784.ct.sendgrid.net/ls/click?upn=abMTnpNEdUy6TRrVbtMqRZ0w0vUGh8jASZ8kZiyf7pwbnLNhdJs-2Bf-2Fj44ti07L-2F6d0Hc-2B5ibn4hbvtTYwJLFNJ7AkC8xom-2Bda86t2ys-2BKQY-3D2jWt_WgUzRlW8JcO4-2BZvMxspIzInoJnKd8cw-2BYaaJ74Ajk7yYZNC-2FkwdmOwe1RBgt4pyO8VB1EkxP7db8ZHxYvUXzFZukZYSzgNCU18Qqn2MOU92lv6AjeR4B6QE-2BlttguMD20HhqK-2BS3yu-2F3CEwxR4ma-2BcBMtA8WvN9T4ncLDP7beaYV-2BRLHVKSbSWdnKno4sh6Godu9PN3KCD8Wh7vQu4D-2FczQ-2FsamJML9wEKTkAEBlTL8vVYPnboU6ATooz16lN-2Fjp79i4WM6WcuhEdTiWYzBrpgqM-2B4HaIRBBVSxm1mOiHnTB6nKB2eotKItSwjjQREfvgPYR8Jd4OOej6MHll9KYs2To6hl-2BMFxroXNqY3-2FMx5D2INEwIJiuYprib4y8bu1J68yAUOWZ7daNM31Z9fRKKg9ZQ-2B6-2BBd6zCjmoi6GKZYWxy-2B7pJXYUWlMDrU1lG8Z6hRQigVReTONNxZv3gIk6uZcNwvTb3FAZd5fIozWnuT2AvllVShuclO5Of5Ac57lkX-2FJvfFvKUuUIc43RpQyAxThiJg845U3tS0MIEI2EKGWQLX-2F57KoDf7RTIFDEGy3-2FF1aTWJ19FaAuGaUPCg7jBFkzVV9dqLj8ueLBGc1XR-2BNnj-2FjJCntV-2FWuBHS4L0ZfQLhEh6MHiolVqcMx1xb4hI65wtLAafuXyB-2FiwK3ToPr5cP-2Fh0skfXbe2aZng3tfFZ1-2FWxHPmLesDfgd1wPYJOE0q5jnCUobqaY-2BInnxkRaRItrCdG-2F7YaTgqHhTE9SwGMg9PqVzhrFAM3LJU2-2B2V0FaUChHnzu4uC0uV-2BmtM3V4tM9cHDdyFe2A3HUnDT5uSDEEutmgyr7nlXeRTRlGBylnUOPZKSBAsoEkhnVqx5P-2Fw-3D
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
https://u33086784.ct.sendgrid.net/ls/click?upn=abMTnpNEdUy6TRrVbtMqRZ0w0vUGh8jASZ8kZiyf7pwbnLNhdJs-2Bf-2Fj44ti07L-2F6d0Hc-2B5ibn4hbvtTYwJLFNJ7AkC8xom-2Bda86t2ys-2BKQY-3D2jWt_WgUzRlW8JcO4-2BZvMxspIzInoJnKd8cw-2BYaaJ74Ajk7yYZNC-2FkwdmOwe1RBgt4pyO8VB1EkxP7db8ZHxYvUXzFZukZYSzgNCU18Qqn2MOU92lv6AjeR4B6QE-2BlttguMD20HhqK-2BS3yu-2F3CEwxR4ma-2BcBMtA8WvN9T4ncLDP7beaYV-2BRLHVKSbSWdnKno4sh6Godu9PN3KCD8Wh7vQu4D-2FczQ-2FsamJML9wEKTkAEBlTL8vVYPnboU6ATooz16lN-2Fjp79i4WM6WcuhEdTiWYzBrpgqM-2B4HaIRBBVSxm1mOiHnTB6nKB2eotKItSwjjQREfvgPYR8Jd4OOej6MHll9KYs2To6hl-2BMFxroXNqY3-2FMx5D2INEwIJiuYprib4y8bu1J68yAUOWZ7daNM31Z9fRKKg9ZQ-2B6-2BBd6zCjmoi6GKZYWxy-2B7pJXYUWlMDrU1lG8Z6hRQigVReTONNxZv3gIk6uZcNwvTb3FAZd5fIozWnuT2AvllVShuclO5Of5Ac57lkX-2FJvfFvKUuUIc43RpQyAxThiJg845U3tS0MIEI2EKGWQLX-2F57KoDf7RTIFDEGy3-2FF1aTWJ19FaAuGaUPCg7jBFkzVV9dqLj8ueLBGc1XR-2BNnj-2FjJCntV-2FWuBHS4L0ZfQLhEh6MHiolVqcMx1xb4hI65wtLAafuXyB-2FiwK3ToPr5cP-2Fh0skfXbe2aZng3tfFZ1-2FWxHPmLesDfgd1wPYJOE0q5jnCUobqaY-2BInnxkRaRItrCdG-2F7YaTgqHhTE9SwGMg9PqVzhrFAM3LJU2-2B2V0FaUChHnzu4uC0uV-2BmtM3V4tM9cHDdyFe2A3HUnDT5uSDEEutmgyr7nlXeRTRlGBylnUOPZKSBAsoEkhnVqx5P-2Fw-3D
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133240551294481681" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3008 chrome.exe 3008 chrome.exe 2232 chrome.exe 2232 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3008 chrome.exe 3008 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe Token: SeShutdownPrivilege 3008 chrome.exe Token: SeCreatePagefilePrivilege 3008 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe 3008 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1824 3008 chrome.exe 85 PID 3008 wrote to memory of 1824 3008 chrome.exe 85 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 4424 3008 chrome.exe 86 PID 3008 wrote to memory of 3244 3008 chrome.exe 87 PID 3008 wrote to memory of 3244 3008 chrome.exe 87 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88 PID 3008 wrote to memory of 5024 3008 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://u33086784.ct.sendgrid.net/ls/click?upn=abMTnpNEdUy6TRrVbtMqRZ0w0vUGh8jASZ8kZiyf7pwbnLNhdJs-2Bf-2Fj44ti07L-2F6d0Hc-2B5ibn4hbvtTYwJLFNJ7AkC8xom-2Bda86t2ys-2BKQY-3D2jWt_WgUzRlW8JcO4-2BZvMxspIzInoJnKd8cw-2BYaaJ74Ajk7yYZNC-2FkwdmOwe1RBgt4pyO8VB1EkxP7db8ZHxYvUXzFZukZYSzgNCU18Qqn2MOU92lv6AjeR4B6QE-2BlttguMD20HhqK-2BS3yu-2F3CEwxR4ma-2BcBMtA8WvN9T4ncLDP7beaYV-2BRLHVKSbSWdnKno4sh6Godu9PN3KCD8Wh7vQu4D-2FczQ-2FsamJML9wEKTkAEBlTL8vVYPnboU6ATooz16lN-2Fjp79i4WM6WcuhEdTiWYzBrpgqM-2B4HaIRBBVSxm1mOiHnTB6nKB2eotKItSwjjQREfvgPYR8Jd4OOej6MHll9KYs2To6hl-2BMFxroXNqY3-2FMx5D2INEwIJiuYprib4y8bu1J68yAUOWZ7daNM31Z9fRKKg9ZQ-2B6-2BBd6zCjmoi6GKZYWxy-2B7pJXYUWlMDrU1lG8Z6hRQigVReTONNxZv3gIk6uZcNwvTb3FAZd5fIozWnuT2AvllVShuclO5Of5Ac57lkX-2FJvfFvKUuUIc43RpQyAxThiJg845U3tS0MIEI2EKGWQLX-2F57KoDf7RTIFDEGy3-2FF1aTWJ19FaAuGaUPCg7jBFkzVV9dqLj8ueLBGc1XR-2BNnj-2FjJCntV-2FWuBHS4L0ZfQLhEh6MHiolVqcMx1xb4hI65wtLAafuXyB-2FiwK3ToPr5cP-2Fh0skfXbe2aZng3tfFZ1-2FWxHPmLesDfgd1wPYJOE0q5jnCUobqaY-2BInnxkRaRItrCdG-2F7YaTgqHhTE9SwGMg9PqVzhrFAM3LJU2-2B2V0FaUChHnzu4uC0uV-2BmtM3V4tM9cHDdyFe2A3HUnDT5uSDEEutmgyr7nlXeRTRlGBylnUOPZKSBAsoEkhnVqx5P-2Fw-3D1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b0f39758,0x7ff8b0f39768,0x7ff8b0f397782⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:22⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:82⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:82⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3240 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:12⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:82⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 --field-trial-handle=1824,i,2089242808070123280,14465379385586427604,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6184caf7-dca6-4495-82fe-12d376d23f04.tmp
Filesize5KB
MD50f17c1ec64a01b99614ca1d58f73d3ca
SHA18d86bbb8e450a1827de0c14bff50b0ce76e7772b
SHA2564261e7577df5153bd92e15b844c03dc2d93df36858d2048c1de8da67bb916f7a
SHA512efce0ed771ebd50dd21d49658be803821b3a97a154c1498f5f9cdf2ad4fa9402b640149c2c80e7be04918359679387a3334651743563cc7338df25606da9c378
-
Filesize
6KB
MD5baf4f702f29ee028f29b6df2ca678bc0
SHA15219722f93a0d16ead20155932525da34a0a78cc
SHA256a8bae964d7bc38fe4dc79f87ff3c9e4f3559968f800a989f8bd8e5cc50a3ae61
SHA51271e37238fc3e1f40813a3df953c40182a0c1d2acf2260f6c9eba37e54b419dd1bf10df78d689a0a0496f8309188733efc9a268c8fdb0b629526520e101f5cfde
-
Filesize
5KB
MD533d0125406cad338a6e376f9dab65e70
SHA11a491126901bf246442b093acccbeeffdfb16056
SHA2568f85d7332f89247b9013e156988ddf34d0ee0f75ff6a6d3ee2e0e445608d2978
SHA512239d2680d62fb1eafb09975f4b3c84db616ee7fb1386fc4cbef352d3a9bfc3efd47613bb74d99348513a23fbeb2ba595c77882e2f856d4aaed8fae36043acc08
-
Filesize
145KB
MD56b1cd92073b13f91a6288e771d71f008
SHA170b94fd696f0346a4157c0ad0e396e66cb44f7bc
SHA2569410923e7d2ce2a46da11c671dfed890ae06de014be3650efec2a04d76223e4e
SHA5124c74fd81e5465f4b78dee8bc8bf36cda4f1d08e0b6df523a1ce44906683a5bfee5abceab43a09deea336c4567e0112d8a63981252a46cab232a493944991731c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd