314b54052a5ac99ff7adec59dd16113e7c528640b42d2167a7bc077883108714

Analysis

max time kernel
952s
max time network
920s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-05-2023 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CeleryApp.exe
Size

8.7MB
MD5

199b78ae4949e675da78b3e87ebf91de
SHA1

01cbe6732f202d69ba03b4de5ae426e0a8520508
SHA256

314b54052a5ac99ff7adec59dd16113e7c528640b42d2167a7bc077883108714
SHA512

35f3233d015c85a8502419038130b25cc4ae62886e01c5e2dcfab15c27ab46b2c82035605cdd46a7bbebe0f12e59971e8765d9035a16b48ff2bc79e19d581972
SSDEEP

98304:MsgLIRfyC7egWJ3rJzdDf4fwraOWcD9XdMPABIw/t6KHDicVwzUsy:Msguheg44fJOWs9XNBZ16M2cuU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1344	WerFault.exe	27

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1296	AUDIODG.EXE
Token: 33	1296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1296	AUDIODG.EXE
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe
Token: SeShutdownPrivilege	1956	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe
1956	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1648	1344	CeleryApp.exe	28
PID 1344 wrote to memory of 1648	1344	CeleryApp.exe	28
PID 1344 wrote to memory of 1648	1344	CeleryApp.exe	28
PID 1344 wrote to memory of 1648	1344	CeleryApp.exe	28
PID 1956 wrote to memory of 1380	1956	chrome.exe	34
PID 1956 wrote to memory of 1380	1956	chrome.exe	34
PID 1956 wrote to memory of 1380	1956	chrome.exe	34
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1496	1956	chrome.exe	36
PID 1956 wrote to memory of 1928	1956	chrome.exe	37
PID 1956 wrote to memory of 1928	1956	chrome.exe	37
PID 1956 wrote to memory of 1928	1956	chrome.exe	37
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38
PID 1956 wrote to memory of 768	1956	chrome.exe	38

C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 896
  2⤵
  - Program crash
  PID:1648

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef57d9758,0x7fef57d9768,0x7fef57d9778
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2172 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3896 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4008 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3916 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4496 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2492 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3860 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2760 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2496 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2680 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3864 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4532 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3616 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2468 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3988 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3448 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1296,i,9256281304012025542,12577052525789340749,131072 /prefetch:8
  2⤵
  PID:2736

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\833c2986-0d0a-4bb3-a506-6c8f508c94cd.tmp

Filesize
5KB

MD5
a3a8eeb7962a6282fc2f99cf8ece9576

SHA1
f21caa87ad7ec4a9838a7574b60b9454142a9d5e

SHA256
ba1e9467befcdc835ac19ac70436adc41a93a4ab8959f56c41821552a82ecfc0

SHA512
9dda4dd574af32d3fdc49dd77b254454f88fadb89c409ab520e94609c2753d5a022f9c125bf060b8bf326f11dd8c4290683b190631dee157d818edfa32923f15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
37KB

MD5
519005befdbc6eedc73862996b59a9f7

SHA1
e9bad4dc75c55f583747dbc4abd80a95d5796528

SHA256
603abe3532b1cc1eb1c3da44f3679804dd463d07d4430d55c630aba986b17c44

SHA512
b210b12a78c6134d66b14f46f924ebc95328c10f92bfed22a361b2554eca21ee7892f7d9718ae7415074d753026682903beba2bd40b35a4eeb60bf186dcdf589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6e7466.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
adbc4d901d7bb9b4581c96bfa8efc97c

SHA1
ab48ab2ee21f1098e5cf3c2e9cb63622d2640da4

SHA256
79b60ec8347cb9d9bf75db13a0395a3de857825a99e0be29fb4bd79124a9cea7

SHA512
98588409ed7e6be1cb4f9dc0fd7f5c2fe4985eee9ba62c2f390f496c1ec802a1ada4f56e2f0b94be077ca89ecd4a114dceccbf2fab17ec5fc929bf372500a4a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0a91f99acebb02911e3e9f9eebc93cca

SHA1
8bf323ab590fb0eec0d99ff2fb055c02cbba2d57

SHA256
9e54e18a73a29e984b7db9c7f4003936287e66d4fd3e48cee2029a2f3bd9b8c7

SHA512
441c31f41aceaf3656ff5398e93c3f8a3a20f362ab56e09eaf4d8c925ebf24e5f947487949b0558c3813707dbfd01529c5734bbf1c35602be60c949c802a63d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b40d823346682651ae23ca42ca0fe3fc

SHA1
e93c0b10f5e891aa7bed7ae55f3c2dcd654c5f52

SHA256
4a91cfbb84744bd8d06d69b0077f59f6ee8d664fc7063dc9b96bf879b8f4e9f5

SHA512
7079a2b31dfc8af5dd685fc3abee0b7084d0debec0184f517e906cc568e84bbf8b176e2db41173e2f4f196e6b290033335459245855e8e40b415379b3312816a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0167b5ba6ad7ceecf88d165b3aed9a39

SHA1
ca4f123432e2e3720d054b4b05570bac12a5bc6e

SHA256
af1be96eb100789d37fa5a5412d315c76d1b15522422c1f562defbf4725640fb

SHA512
5f36529cc2e392a74b8c581a33446a51b19ea1f6dc78d0b4af6cf4825a11705fc1eac98d9081756e938536773f8cd3de04106168fc7ee2bee7f0a911fe0cf141

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
527B

MD5
cc8700af3f087d58e63d515a4bcface2

SHA1
23f06dae98b95d213a574a67f301cd4d1218e4c3

SHA256
c532b763062f4b3814925174fae414f1fa58d438518448609fd9f1c8affa93df

SHA512
09dc66fa6820a715fbcac0ffed9517beefa7ffd04d6868ae4dd082a77a0ab2674093d0e1f174a71253cf82acaaf0763af7defccc310692dece8789f1d63b3c63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f3a2d2bb0c6e6015064f42741faa3980

SHA1
6c47002df62cb25e9ddd2d00bea1814b15042622

SHA256
5144a9dc6564d2c6ae5fc3bdbdb614f1926241983c42a51fa8c9435fc9d3aabb

SHA512
2181dc495dc03ee6bdbe05e80d30d04d8ef46342b56507699677f2d2f022e7aecfc059f922d0ef570c330369a6bd618879d1505e6d6ffea3a7c9e10328911d26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3db3c6080c3090a807d0c8ded9f01e13

SHA1
3232599ce1ba26be9cf5db6f6a0ae514c47b2616

SHA256
0a2bdc94d433d31312e8007fb21bcf2bf17bedf9fb963d3196f6bee4a76248d1

SHA512
f3fb22ab7111b358f7cbca0bdd0f8ce8c099764bb9a9fc531718978e352479acbcd43aa7790103e5f8c6b44f7273f0d5de9f9601fae86861cfd2bc919386b6f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
143af77c2665e8e870b30f023ec2564d

SHA1
3c28cc85943c0b7745866ef487a594679710723e

SHA256
63b41c614c2a7f6a366760183787c434d5f5b31b7180a43c748577279bc015e0

SHA512
0b74dd5960ea41a9a5fdbfc622f35ac087abe7be1c4eb8bca4e848d0b3140bd6ed8fdbcadf73f44ea94405a837ad5b7d3f4a980579483912bb0236687115fcb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
bed19fc022888a87daeee8f73fc13f0b

SHA1
f385d8fae51170b29df4c39cf770cc489536b7f3

SHA256
a6b8dc91b5625dff5dc0c127f1f861f9b08856d528160b7e9c48f55f82ce50f6

SHA512
11f36c0f92bf598bb64a1dda88678ff59ff606b341c19c90746baa739ce4924fee431e48206e40efd6e1ca7d6df9cdf6492664b3dfc9055d302e604c57904d22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
4b60e812526ef9020c874e24ba965834

SHA1
dc94c44463a829a3b28b60797d958d27ec6f1c8c

SHA256
84319c4734a27abfe7b07397888cf060178a7ba5bb847791bca122648993f23e

SHA512
dbc81f989008c1973e36387903826b81620e87cff1c4e4225fe370b9453cfdbaf2eedea9e2b88e1d9fd042a90f4309e195e747123e625021bbcdc3805779a516

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
0b4704d232683dcebe5034dc54e52c26

SHA1
6885b5543fe71f1b080d9804f8cf0cc9a410d7d3

SHA256
adf332c51441777f68bc9ea971e8612e1abb23d000eceb62f11d6bdb26f444df

SHA512
cbec90a3dcd3f8fa1edccfa6b24aa55e21fc1b348c5cfb4ab65e3b341a0cce430aaa1cf8a5c02c4b1f66beb3c23ddc47f9c1c4ec320311107eb7a8186b744f4b

Download Submit
memory/1344-61-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/1344-54-0x00000000011E0000-0x0000000001AA0000-memory.dmp

Filesize
8.8MB

Download
memory/1344-60-0x0000000001150000-0x00000000011C4000-memory.dmp

Filesize
464KB

Download
memory/1344-59-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/1344-58-0x00000000050C0000-0x0000000005100000-memory.dmp

Filesize
256KB

Download
memory/1344-57-0x0000000007A40000-0x000000000835E000-memory.dmp

Filesize
9.1MB

Download
memory/1344-56-0x0000000000BF0000-0x0000000000C40000-memory.dmp

Filesize
320KB

Download
memory/1344-55-0x0000000000A60000-0x0000000000AA0000-memory.dmp

Filesize
256KB

Download