Overview
overview
7Static
static
3gs10020w64.exe
windows11-21h2-x64
7$PLUGINSDIR/EnVar.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3doc/GS9_Co...nt.pdf
windows11-21h2-x64
1doc/Ghostscript.pdf
windows11-21h2-x64
1doc/News.html
windows11-21h2-x64
1doc/colorm...e1.pdf
windows11-21h2-x64
1doc/colorm...or.pdf
windows11-21h2-x64
1doc/colorm...re.pdf
windows11-21h2-x64
1doc/colorm...nt.pdf
windows11-21h2-x64
1doc/colorm...le.pdf
windows11-21h2-x64
1doc/colorm...S6.pdf
windows11-21h2-x64
1doc/colorm...nk.pdf
windows11-21h2-x64
1doc/colorm...nt.pdf
windows11-21h2-x64
1doc/colorm...le.pdf
windows11-21h2-x64
1doc/colorm...gb.pdf
windows11-21h2-x64
1doc/index.htm
windows11-21h2-x64
1doc/pclxps...dl.pdf
windows11-21h2-x64
1doc/src/Gh...nt.vbs
windows11-21h2-x64
1doc/src/Install.vbs
windows11-21h2-x64
1doc/src/La...on.vbs
windows11-21h2-x64
1doc/src/Use.pdf
windows11-21h2-x64
1doc/src/conf.py
windows11-21h2-x64
3doc/src/footer.js
windows11-21h2-x64
1doc/src/header.js
windows11-21h2-x64
1examples/annots.pdf
windows11-21h2-x64
1examples/spots2.pdf
windows11-21h2-x64
1examples/t...gb.pdf
windows11-21h2-x64
1examples/t...ge.pdf
windows11-21h2-x64
1lib/afmdiff.awk
windows11-21h2-x64
3lib/dvipdf
windows11-21h2-x64
1Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/02/2024, 15:22
Behavioral task
behavioral1
Sample
gs10020w64.exe
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/EnVar.dll
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
doc/GS9_Color_Management.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
doc/Ghostscript.pdf
Resource
win11-20231222-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
doc/News.html
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
doc/colormanage/figures/DeviceN_Figure1.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
doc/colormanage/figures/Object_Color.pdf
Resource
win11-20231222-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
doc/colormanage/figures/architecture.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
doc/colormanage/figures/des_profile_intent.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
doc/colormanage/figures/destination_profile.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
doc/colormanage/figures/ghostscriptR_stack_RGBclr_CS6.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
doc/colormanage/figures/proof_link.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
doc/colormanage/figures/source_intent.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
doc/colormanage/figures/source_profile.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
doc/colormanage/figures/text_graph_image_cmyk_rgb.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
doc/index.htm
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
doc/pclxps/ghostpdl.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
doc/src/GhostscriptColorManagement.vbs
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
doc/src/Install.vbs
Resource
win11-20231222-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
doc/src/LanguageBindingsPython.vbs
Resource
win11-20231222-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
doc/src/Use.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
doc/src/conf.py
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
doc/src/footer.js
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
doc/src/header.js
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
examples/annots.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
examples/spots2.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
examples/text_graph_image_cmyk_rgb.pdf
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
examples/text_graphic_image.pdf
Resource
win11-20231222-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
lib/afmdiff.awk
Resource
win11-20231215-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
lib/dvipdf
Resource
win11-20231215-en
windows11-21h2-x64
General
-
Target
doc/index.htm
-
Size
284B
-
MD5
18cd38d36306d6657f58374878e06fd6
-
SHA1
50d2b1e3e6ca69068d6488c1445e80e3d83e4b0e
-
SHA256
807b78759b1e5c27275e82bebd8886045242d3083e8ed1443af79eccdb4265ff
-
SHA512
1dae5aea491908683d6d3cfca7ccd3953dfd273f1fe078bc826cd55f2a0e652dcc2753bf18262e68eeeca90d779fb40fbd56a38f88b396d787cd6ca07dc94700
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133512746351930965" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 3504 2272 chrome.exe 76 PID 2272 wrote to memory of 3504 2272 chrome.exe 76 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 5016 2272 chrome.exe 78 PID 2272 wrote to memory of 4812 2272 chrome.exe 79 PID 2272 wrote to memory of 4812 2272 chrome.exe 79 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80 PID 2272 wrote to memory of 4576 2272 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\doc\index.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2c179758,0x7fff2c179768,0x7fff2c1797782⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:22⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:12⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:12⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:82⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:82⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1624 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5412 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:12⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3704 --field-trial-handle=1844,i,2633099798008584480,1954444406309871303,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD5083b83e970b0e3ee9f01b829b3a6a6d2
SHA1608ef97f57bac1bc17d91300e41a05718bd77dfe
SHA2562549011ee1724f5bf25aa0419cc680bfc05f0967c64523532e245ba3c5071901
SHA512e748e83a5e947a1f67826510de1752b469c12c73ae35f6e89c19c52a0bbc378c65d9f09fe9c8ee1cc86abcd59cfcb2c254ef4882eef4d3ef12de24afce53dd37
-
Filesize
2KB
MD5833758c1c32eda7b5f15d33a007e6c25
SHA1e945f84bcfe1757db7be9705d79c99a8a20f65c3
SHA25609005964be15196be5dc5e951163805d2b1100a81e69421cd3d9be290d44340d
SHA5122e93b2795690e6191d1ccef6074bb8a666a1aba5fe5db1065ff1c13acedf1291e986f5c23fc333d89f39510bb92779e1803e20b2fe07ca380c4e7130222c423f
-
Filesize
1KB
MD561a04e8d17f6d39583c6d8bf393c6f18
SHA136f2c08d8617dafe02ae44001c75ab3684bb84bc
SHA2560d1f9a76af7dbedfd773d304df4cc4ff5de8be9467df9176b7b227f8a4a40922
SHA512bbbb1bf1d6e9a5ad9a79a936216889dfe0d2230cabb4a977eaabcbcb0ceae9483a9c484938b5b38e9166bfa69a149ba3256672ce0ecb2931f166fe3a78fb6974
-
Filesize
1KB
MD52aa8cf49322c706dfb5f174e69ee94c2
SHA1afa10f7e26e27f2d81e70cd274436ede7976ae4f
SHA256d182c195c3ccf278753aa6d238a47406e8b3c8537736de978cf8a1169f2243ca
SHA5121c4e887d19d0189f29027c8aea7ee4dbdc83711f5af159c98cab9c216bdbec9fbcee421d29b13dd98b7951079e95c0f47e8a9b70088d0f3ee246b69d5d9ffe1b
-
Filesize
6KB
MD5b1c463d93d160a033efd5fb49bfb0c18
SHA1599dd9f4aa74695053065341fa48740fa132772c
SHA25605cba425a846b9ee137d5f58220e64cceb173a3e72aaf85e91a5aa563dc9b921
SHA512d8e2a1600b7cca6c11321b94e378775e78e69aaa36c1cad59df36dc2e468678e7c10d610a9326014aaf424b4d922c9511ecf2ed192fc7dcf026ad870380995d4
-
Filesize
6KB
MD569465a2a8d6bfa3837727977dd60885b
SHA12fbcb8bcb8a05dbda9fde370eb41974566f3f8b3
SHA256bbb12d26344978fb7dcca01a82d8d877a0c35bf56143ec752d2a197403cd7b72
SHA5124afe58f6277ce706921eb7b5918c97e6c3aabf198ca1ef59d339154733fc49006be2085177db662d3bb7130c1dcd01e18a4f7e00cd5c1c8ee0711b87d9c566c6
-
Filesize
114KB
MD594e805fc9f557f1ef22ccf9df6c930bf
SHA153bb1050acd368eaa7169116e6c8cd73d7314c92
SHA25663ed754c776bfe20d884dc3bb89ab8f3644bac9ccf2192a4dbba01e8ccc94edb
SHA5124e24577b974ee0298835e0bad046e64082ba9fd9e0d37468f361d6c75856d566a3246f7e43fd6e2c8243177509bb3903c39df955637ebbe450d4f0e36d335e09
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd