hxxps://www[.]megarecargas[.]online/

Analysis

max time kernel
30s
max time network
97s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
11/12/2023, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.megarecargas.online/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 940	2396	chrome.exe	14
PID 2396 wrote to memory of 940	2396	chrome.exe	14
PID 2396 wrote to memory of 940	2396	chrome.exe	14
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2588	2396	chrome.exe	31
PID 2396 wrote to memory of 2624	2396	chrome.exe	30
PID 2396 wrote to memory of 2624	2396	chrome.exe	30
PID 2396 wrote to memory of 2624	2396	chrome.exe	30
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32
PID 2396 wrote to memory of 2688	2396	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.megarecargas.online/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6719758,0x7fef6719768,0x7fef6719778
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1260 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3212 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3488 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3520 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2536 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3552 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1460 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3492 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1464 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3588 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1360 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1876 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3552 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2492 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2260 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1916 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3592 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2520 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=1740 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=1360 --field-trial-handle=1208,i,5528118696311948027,7410840896383245992,131072 /prefetch:1
  2⤵
  PID:900

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0910ca47f7634442dedddd44c929d2a1

SHA1
d304bbbd23ed832581aca9d5e6cdaa58a57a4753

SHA256
1abaf8b2e3d0626f987e6e055b8615e889f53b0034c137f63c507e742c790882

SHA512
e6094ead0aa6d2c989f9671baeabd5a50804b1f838d27dc441f2d9519942fdea471afe45b807355c2cdaba207ebec23d3ddbb5f36d2037db3155deb1a4f7ba5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6b587d12a22b78b650328117fdce83b9

SHA1
bf58a01ede041f116cd8c716445397960899da00

SHA256
723f329fdf9f484a8baa8df22af680b3a5683b0b604b3e9abc53f93e28d2af46

SHA512
5e18cdd45b45420aab6b46c1c6a70bfbfa69f01c568b81b78e869cbe59d1520018ea981445c2e7306fff34c056a6e334ea3464cb482c33cd61310153ef8e3e58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e8257b1ccb015368e0d287b128e7340f

SHA1
d6b976a4a072c94cd31c906134501d2269b6dc7f

SHA256
baff94eae6aa2b7002cb763bd7d69402b7637d90b1d8d6d90764766fa2d11428

SHA512
3e4b2f19f4ccd16e312dd6542884389412daee73a98e6abaa0ebf67519ec90077ef4b6e80d24df62914368b46ed77507c25c71fda0bfbc24c9c3b85da41a05e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
68KB

MD5
2093c7e8bc98989779d6f60fe8d19ac6

SHA1
f798e8642e0a277dd63d83c2413578133115d89c

SHA256
938ee3eee093061f36c47c9c6da120464f9a99c997a92b08bd0cc3420f3ed162

SHA512
424b72a7e95f83e3522c45b8028f1c30a64f75a3d242d2c50db82b6d5505880a37ddd09ca662e2fa9e83f45016bd5e5c2b28c41dd3131a38a93476b02c7fd0b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
316af114841819cf82cd18c1c00ba5ce

SHA1
db87091fa101ec8c23e0751aa2af3ef314aee7c9

SHA256
62dfcaa7049cb1bb59940092cb7bdec651acd35213c4f46e86d4386d8352ae7f

SHA512
6b41f379a0ef397f1493b7c1cf450f3e45c095dd494e489fc2e97ca2173f8d10df6a1eb6e161697ef944bb6734a64706cd87c9ce0b9ae4862780544bb2d23564

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ca79a26864c5933266f21f5671f91ea1

SHA1
1ff610aa8cb493b5da677fa2d7c9fc6b3d279ae2

SHA256
7a11eda291f5dcc3902513563038a88d7a0ca4ad26d0b3d8e5b5cf3cf70ca567

SHA512
20f70c4e7e9294b323687ff5d5b967fef36cbaf0e759bbc3efe98c6c57338c32fab91182d6621b12fc7179d6ab5642f72ca1e6a71b99c1e36f8f53e401b94fd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
55e06005e11bd6c4a6e89909aca74e48

SHA1
b065a235a218cdc5bd6704d42123da572ae9fa8d

SHA256
0d1d3b3fd050d810006aeb9750cb9db807cf99e3c268db826872dce238fd84d6

SHA512
e2574633f2afbdc1ce4de36d894afd7277788769ef0ffe7dbf3943639b8cafe06499864b0f020319cd6affb36c9bd22d25fcdbeaacd36d3b71753c1c0c40fae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFf775f5f.TMP

Filesize
6KB

MD5
f365044f56fb3652cae0611fbfc0eec1

SHA1
20fde2334e9e555675d971863ba5bd0be3e46d94

SHA256
996d642d675b4d5a658d08285a8ed5d8c2b7c0c1a30bc2e72a05513dfdc6fe53

SHA512
c927d7d776f100483152021ac38bd6b0b6e7a3586be422dc1d4fcfed24d6d62aa32f79280d0d748672964150a679b57033064ba492473a7b4ae4df62dedbea4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c44c91f5-4a60-4190-bd9b-3f80df2c9d81.tmp

Filesize
5KB

MD5
098f0ada746030b522808c3d66834db1

SHA1
43dcf482b143b2071083f9d3c3b5c9c47e3c8359

SHA256
fd1a0c6422c76fc79c74093a93b1710f4c8c9fd395ee3d3663fa4d0d26deeb7a

SHA512
565028dbbe1277047af4bcf6974db84037ccc70c997aaca51fcfb0909a8e320962dbc43e0db2b86689526e256d7c6ff9cb51126c6494042b50317d1e95fd5065

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12BB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit