hxxp://www[.]google[.]fr

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.google.fr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413105963714885"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 4948	1032	chrome.exe	80
PID 1032 wrote to memory of 4948	1032	chrome.exe	80
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 1832	1032	chrome.exe	85
PID 1032 wrote to memory of 2656	1032	chrome.exe	87
PID 1032 wrote to memory of 2656	1032	chrome.exe	87
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86
PID 1032 wrote to memory of 4820	1032	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.google.fr
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd02ad9758,0x7ffd02ad9768,0x7ffd02ad9778
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:2
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4512 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5012 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4552 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5272 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5516 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5660 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5808 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5824 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4564 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5988 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5848 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4948 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5328 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2380 --field-trial-handle=1876,i,6350569644004000164,3714255180273462425,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
72KB

MD5
d13752b74154c89b72caf7330418fcd4

SHA1
849e3fa5e8e004789a3696d0f0869a2f4ea7708f

SHA256
fd7bc4569022a389ba01af30c1e40e11574f07d9b80bc294096acb7088301b5d

SHA512
2dbc79e997acae6c5e5a38d3e057dc45d9abbb7b7fbdce44d2c906241700b9eb241d8d1f4400ba17ea36eea682d32209e5839c1722528bc149ca3478150da6fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d

Filesize
40KB

MD5
7af63db34db605d8dd2c1c9a01b1e053

SHA1
0a78f5165c37eb51371afe2e9dde9ea1f70b8912

SHA256
b4f04e6c5f7e27398f72dceeb47a4711f6b4d475c4a2c8c23e8930d6718ce938

SHA512
78387a5038d814c1ac71a35bb44e0e1e9a49456e4b0da8e38766f3ca3f4ce9f973926697701bb1cfc47552dc11ccbb1326488e0a28f1b1f0cd96e60ace05a8b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039

Filesize
185KB

MD5
a9673bd087b4e5e2cd21862f8b7d8054

SHA1
0854f56b37b3c7c3938ebdd75a79be32c94b281d

SHA256
d4226b650de255fdc92e6ba1b89181c445fa23e82e86a1de62059ffde35081b2

SHA512
3e919945421b284915da26cd49d55db1e4c5b0530cfafec936982e2b6f400e372b98df78d1f07813a473cf9f26699e9c1ffa555904d6d2b4fc819b2c202afaba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
805f29556d9b066b9789f0b5440c1c1f

SHA1
5212b0b520c11cbb4493dd80089d16c3aa1cc9b2

SHA256
ea727a03b8c2f5377bb6d803b82a372a8ed1ade442d57238af041961e9f36574

SHA512
6006d1f5a88d970a21440d6d0db5370da7a66473fb39d70c09884942724f71cd6e72de8fa112b6727da76b515aab61054ee728b8f7ab97cd0a9a28949e047749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
1abef8f28a47b71ca367a55e1708071b

SHA1
379907ba4a53551dae4965e03bb45123d634c2af

SHA256
2f770e89411de055915cfd716d0b6cd18b0d3c3f3a3a395c4b8a0e616b1b451b

SHA512
bf6ace4de50bddf7d8f8a6b0a4c2e83ebd1c2bd97792e08c7a58b68ad31912562e4a040d1a44c359eb9471764d364e97f6e3387b71eb23fea6622eec911761a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
11453969ee6a0b69c86e94bc4127779c

SHA1
47b22ece6785ef503968dca99b6a0a7cc2d34ddd

SHA256
d63c7117cba096501d04f48ad257f9b557ce3ee9b1aada0be74c5bdad4ed1c39

SHA512
f05872eab63e1b92af7e785b4a6f2ab77010574cec87eabd7000df2df2d601d9bc03b4547ef7c68e011cfc8d950c6979f5dd5a524a5a802ecd1116eebdd64150

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
700B

MD5
c1db33cafcb690e4b1975c79733b0f72

SHA1
e9e01dcfb3ba85aa8b090fb70c67afcb23c47afa

SHA256
154fbf8fea6648f96ea59ba623d44a0a72ead3a081133c365b7c742fad2d0b7b

SHA512
5068d642771bf90d32ead400f39f6638fd8a8ed6ec23bbfe6707d7fa2efb3a74a8c3399dc772c2a0ac563a5d99f5f1c0302c1dd4fcd8664b0a2ecc90e97cb138

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
34084e7489e25bcf78532e8eaf4b7110

SHA1
3692eb202e80890fdf3bb57f4df0c72d38a3a40a

SHA256
307a00673cec2f3c273b348ee78dfcead5ccdddf644138392a9d79199ae8077a

SHA512
f4071237650dd5e9774fe551480693bba970da06134cf95bb91c03725fac5041e10c48ae04f0cbb06e4f9d0fff3916cc62ca9c5488eafff7473e68bda3435c58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
39eb8c05009406482c37f92dd2d3291b

SHA1
fb17d960983fb56744ffc17189adc930a059f933

SHA256
e82a04322715f3b6cda1d8bf091c0f8a73530cd4614d88253f6e5b08d7f3e5a9

SHA512
32b2f248e58ef19e2c519a63074c21c9cded4ba832fda77df3ab9e797d8746adf7f263d03b71b2145f8921b869817f0ac38d34a1f5e536cf753d31bccb9aef6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0342df3625cb5e74830cdf2725771b6c

SHA1
4fb8b3c4c36e0ab149264ee1c73c86051b444a73

SHA256
317be6052a529e3a2b754d62caccc87b3645b9d267b6417acb5f1220abee4dad

SHA512
7e63044640b17d37fb985cf3e88451da1c8be4073e5f8b5f8a409fb3940032d3177626ec72fafd6baee9470bff714c13cbae59a124ee19d1848ebd7360a9af26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
7d4fffd47918f9b6df024666d2375c4f

SHA1
883d60d3b935392d6de48b6e1845826127073532

SHA256
206b8eefc8f348ac244cf720882a8dc6258d0168916dea379e3f842dcc422c5b

SHA512
1b62a470d63afb88fac0c8a52b815c3ff9ad41194174db31d17b91049ebe20280d2e5d29890892c719bd66c59f3d0880d0c76a7dcd2235961627402f945984ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3977369c89096e262c09f10adc2b7aa9

SHA1
b78a738eb4153236d817bc570e35c2577b87f976

SHA256
1483b2223c9291ddfd980628215edfde4a5a72315a681cbcd088e07aea043374

SHA512
8f8643a8e29b9f4fca9f24a74c0155c6ea8bb5dbd4350311b2375926252fba5655cf3f999201ae5a1823878ff9690389821c66913692eee44b6e673f016440e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582c3b.TMP

Filesize
48B

MD5
7549b0115eb9cdc865cf654123d196f2

SHA1
2204f1a90bb0400bdd072d362bacbd4bbb1c4d6e

SHA256
1c65df5edfc9e901a7e4eef533fd69e000259eb3c31b6ee9ba5c07753223931c

SHA512
b20b7a3a26a17dd5662c04347cce85405dab7128cc53f632bf83f25abde7df9797518b758e86657628f3d9610a65a7f02ecf666c36259d422aaa929e8b582b59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
d668327e31533c8491ce178fadd92343

SHA1
3a0cd57c2c5438828e2c482e646932129a47893d

SHA256
3e219828ee6ed9f65ded9fcb4db61d1c0bd6aa9f64d2d1c4b4b9c22c669b32c3

SHA512
fe5d353385fdaa06ed6761e6078ca5c234f8bb3e322d96f3465e3b19a9027dc7d17057249da51b876d7e534e742b7307c0bad6a398ac46a80d0658019b5b2d64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
436f4dda9b8621c966536968bad70751

SHA1
c915dd48681665051d94ae6798821a1b1c67ddad

SHA256
fabc6c3d06e209c5bf21d86bfd48817ec37af23ea60826350795b2e864976a41

SHA512
453e000b1bc379bd83d606e5e8057c5d5a205759eabba0e09e6530b11b94e78545689fa6efe5b73e48249107fa25920703e7c9bec18f86b4dd2cb29b60a506c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit