Overview
overview
7Static
static
7Buff Achie...er.exe
windows10-2004-x64
7$PLUGINSDI...p.html
windows10-2004-x64
1$PLUGINSDI...x.html
windows10-2004-x64
1$PLUGINSDI...app.js
windows10-2004-x64
1$PLUGINSDI...uts.js
windows10-2004-x64
1$PLUGINSDI...dle.js
windows10-2004-x64
1$PLUGINSDI...min.js
windows10-2004-x64
1$PLUGINSDI...nel.js
windows10-2004-x64
1$PLUGINSDI...ons.js
windows10-2004-x64
1$PLUGINSDI...ics.js
windows10-2004-x64
1$PLUGINSDI...nds.js
windows10-2004-x64
1$PLUGINSDI...ies.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...der.js
windows10-2004-x64
1$PLUGINSDI...ils.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ate.js
windows10-2004-x64
1$PLUGINSDI...ler.js
windows10-2004-x64
1Analysis
-
max time kernel
1800s -
max time network
1785s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2024 18:21
Behavioral task
behavioral1
Sample
Buff Achievement Tracker - Installer.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/app/cmp.html
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app/index.html
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app/js/app.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/app/js/block_inputs.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app/js/libs/cmp.bundle.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app/js/libs/mixpanel.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app/js/models/notifications.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app/js/utils/analytics.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app/js/utils/commands.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app/js/utils/cookies.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app/js/utils/modal-events-delegate.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app/js/utils/strings-loader.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/app/js/utils/utils.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/app/js/windows/cri/cri-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/app/js/windows/cri/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/app/js/windows/finish/finish-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/app/js/windows/finish/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/app/js/windows/main/main-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/app/js/windows/main/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/app/js/windows/modal/modal-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/app/js/windows/privacy/privacy-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/app/js/windows/privacy/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/app/js/windows/progress/progress-1-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/app/js/windows/progress/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/app/js/windows/settings/settings-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/app/js/windows/settings/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/app/js/windows/welcome/template.js
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/app/js/windows/welcome/welcome-controller.js
Resource
win10v2004-20240221-en
windows10-2004-x64
General
-
Target
$PLUGINSDIR/app/cmp.html
-
Size
5KB
-
MD5
d7b8b31b190e552677589cfd4cbb5d8e
-
SHA1
09ffb3c63991d5c932c819393de489268bd3ab88
-
SHA256
6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
-
SHA512
32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
-
SSDEEP
48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133530997244920472" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 624 chrome.exe 624 chrome.exe 3520 chrome.exe 3520 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 624 chrome.exe 624 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe Token: SeShutdownPrivilege 624 chrome.exe Token: SeCreatePagefilePrivilege 624 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe 624 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 1520 624 chrome.exe 84 PID 624 wrote to memory of 1520 624 chrome.exe 84 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 3512 624 chrome.exe 88 PID 624 wrote to memory of 2352 624 chrome.exe 89 PID 624 wrote to memory of 2352 624 chrome.exe 89 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90 PID 624 wrote to memory of 1496 624 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff859ed9758,0x7ff859ed9768,0x7ff859ed97782⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:22⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:12⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:12⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:82⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1864,i,14062953950396734512,1709220946055262787,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
782B
MD5e849bf0c5cf1b1970bfc4cb3241e20bd
SHA1a1f0085862f9257a33e3f10e579d1fccfcc84f76
SHA2565cb797d7728c509461b134494343f5042c35f1853e49045a845cb8ad304f3f72
SHA51232c8dd98be07f1f7e3ad0692aa7ace40b17ea578fc5fad3905c847c619b4d26d609cc20d4aa0ac41e3e6d7c577a030c6db9b9d592ceea799f867b62009964cdb
-
Filesize
372B
MD53c772b91aec65391332b4ec128e72594
SHA1f25084c18309cfb3f4f90ae0b568c9da14383474
SHA256642ba4012dde4bd8a6fc18ccbce8025b9e164c84db2fa994129775ba010acb6f
SHA512f4983c5f8d740fa9d0deb613e7962ae7b90ac4ddf7b058009e612c048eb7745d2564eacdacd209acf69e71fc201c3b8682eeb9b2bf48c8c91b4d228223a97870
-
Filesize
5KB
MD5ffb4acc92c019a9f05e0c1132e4eb5ab
SHA13a1edf39e690118a162f61efb7adae173413c2a0
SHA2562302aefd34ef915fa4bbb915120ec0710ede2d23b9982b77a463b859bdbf8ee5
SHA512e34fd8bc3c344548287ba3fa4279c125bceaf91394a7012a3efa43203d32cfd6cf229a240b512468bc48ca649ec54eef9226ef0cae0a2a418f4c1a0b6988f962
-
Filesize
5KB
MD5f612fb631d42887d0d8962d43e0b0f6c
SHA1a5da93053a92c450647264f0c95034939607a6cc
SHA2566b38d57199ea01d86739fedebeaecd26a6fa24b2938abbc0bc20e13d5460930e
SHA512a62e5ea9605088adf4291744f114e7a466482ced1d2a1c3426e9d943ca483c35a54d48a14a2dba656e472d0f476639985d4b6db754b0f160f5a26a2c679d33ff
-
Filesize
5KB
MD5188266cd3b1ac27908c772ef468f97c8
SHA153df463f8914e69c85e37577383cfaa4ac192c24
SHA256951aec41978bbc4ece12eb75702a0799d02d037b488d7b6b8188d348b8669e0c
SHA512cc56d6fb68f3522a2c2863f78551a197e1f40f48d62d35790d347b8364187996e10ead2a1ce39079ba017a7f9c5a92beb27af3777cb62c245402b101f80e564c
-
Filesize
130KB
MD536bab72e118e31776befda09cc63060e
SHA1fda23482c3502c7fad3cfe7b1ca99d643b13745f
SHA2561e89af985b60fc46912f1366da8cd3c48d428e80a3922f38ac27a3b3a1686869
SHA512c43e10ed3a3c7297e864f877a571250e7ffc0331402f9fad75364e7e9d0d17e9156ecae87d521b2f565fb99599737c0826961c450383d3b6ba9ce54b3bfb1b50
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd