vsingle | eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60

Analysis

max time kernel
1768s
max time network
1292s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.exe
Size 1.2MB
Sample240307-spw2psfc91
SHA256 eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60
MD5 01c13144ea9d9728500dc6c067bab899
SHA1 49b22529fec0c372b08e2afe67eccde13b3ab6cc
SHA512 c05cff167a896ceddb55ab7070301f815f5e4f690e046e30ca6b4381f375ce579d516a70c41b750710e73524d3d092dc9de871cb43be2efc565fd753db2fc2b6
SSDEEP 12288:eQnGcWctmPF319Ib4k24VdTl2ZYFphgIShQuSGDkDFuyjldrB:ecjZtmN7jOVdB2ZYFpqhhoGYDFuol
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vsingle loader

Malware Config

Signatures

Detects VSingle payload 5 IoCs

resource	yara_rule
behavioral2/memory/3552-1-0x0000000000EE0000-0x0000000000F11000-memory.dmp	family_vsingle
behavioral2/memory/3552-2-0x0000000001160000-0x0000000001197000-memory.dmp	family_vsingle
behavioral2/memory/3552-5-0x0000000000EE0000-0x0000000000F11000-memory.dmp	family_vsingle
behavioral2/memory/3552-6-0x0000000001160000-0x0000000001197000-memory.dmp	family_vsingle
behavioral2/memory/3552-442-0x0000000001160000-0x0000000001197000-memory.dmp	family_vsingle

VSingle
VSingle is a loader written in C++ operated by the Lazarus APT group and discovered in 2022.
loader vsingle

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542994848891380"	chrome.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
2940	chrome.exe
2940	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2940	chrome.exe
2940	chrome.exe
2940	chrome.exe
2940	chrome.exe
2940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	taskmgr.exe
Token: SeSystemProfilePrivilege	396	taskmgr.exe
Token: SeCreateGlobalPrivilege	396	taskmgr.exe
Token: 33	396	taskmgr.exe
Token: SeIncBasePriorityPrivilege	396	taskmgr.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe
Token: SeCreatePagefilePrivilege	2940	chrome.exe
Token: SeShutdownPrivilege	2940	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3552	5104	sample.exe	87
PID 5104 wrote to memory of 3552	5104	sample.exe	87
PID 5104 wrote to memory of 3552	5104	sample.exe	87
PID 5104 wrote to memory of 3552	5104	sample.exe	87
PID 2940 wrote to memory of 5020	2940	chrome.exe	114
PID 2940 wrote to memory of 5020	2940	chrome.exe	114
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 180	2940	chrome.exe	116
PID 2940 wrote to memory of 4888	2940	chrome.exe	117
PID 2940 wrote to memory of 4888	2940	chrome.exe	117
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118
PID 2940 wrote to memory of 1812	2940	chrome.exe	118

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\Explorer.exe
  Explorer.exe
  2⤵
  PID:3552

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbad4e9758,0x7ffbad4e9768,0x7ffbad4e9778
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:2
  2⤵
  PID:180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4716 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5232 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5340 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5552 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5524 --field-trial-handle=1756,i,14926051234792811781,17366574441435535203,131072 /prefetch:8
  2⤵
  PID:3568

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93d334d5-f007-4c5e-bd59-94470beed2f9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93d334d5-f007-4c5e-bd59-94470beed2f9.tmp
Size 6KB
SHA256 5349fb3058434c97f2676237d943909c5a9695fd61dc668dfd67a4762d0fdf43
MD5 0e83a5b8393b30f4a1bbe59d19b347be
SHA1 20fda8c76bacd552913e2d009d480c977fcb65c0
SHA512 3d6af92abb5b1e1bf13201ea53450d801f20bb8a7ec7274d0c482bfbe012e4f31300540390e9a61d443286c50750122aa7e9b9814ce78778991a90fd5de8fd04
SSDEEP 96:BXQsXLcjXFkNkKIStO98iZRy7Di+6MsmdeHkyODOTzbjVhYtjEsXt0/cg2Vup:BgsbchsC8syy+FUkyPotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 194KB
SHA256 845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6
MD5 f5b4137b040ec6bd884feee514f7c176
SHA1 7897677377a9ced759be35a66fdee34b391ab0ff
SHA512 813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40
SSDEEP 6144:e7sHFbHCRoslPSywl9fGm+a8pvt6/UVxuxNsPgu0xQN0:ewlbiisRlwl9fGva8dtQUVxu/Huz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 2ef69fe69b2744b4fee9acca6129c21cdb3bb226ebec36b3d8bb67432cf9dcd6
MD5 d9aafdfd3d5d691c0f6995b3d10df96a
SHA1 3835b8d9b987e915973c85e3f1f8b050f82712cd
SHA512 2e68f3e6dbde9a9ec9b4e799539b86c4a0c8403842c71e65486e2fd87a103a915f46a261dbba59f5d1a6a5d0013e018e570cabb9cae1b152106bb7b6776e4d0c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 981bd6304b94f3d9272f4ecc7e308f29d6e711a6fa125c6892ff2d425ec97f5b
MD5 915bc9d18fc4dbdec9e4e82a2fcf2458
SHA1 ba70e3b25b73ef703e2bf5bd5a1989fd02480c43
SHA512 4a50fd7f17d5a43fba16f5cce1ceef2f754cfe98f3333076f9a4b31a0f5244ff915a679d61977209a5ed52f5f5e014973fd83ed3dc0862f37001b765a78f4056
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 16cfc10f25b21fa4317aa4aec3b587325366946f715efa03191288250b293591
MD5 60564af006f9d018a7cb68964d66fca1
SHA1 ef5e5d40817d63e00207a325fffd920b4835be3a
SHA512 7d1882eaf97dfb79d03e41a70672b3cfd9f18d043086a6e9394d3ecf7568ebd085f681a4e99f3cca1cfff2842c755d65f23f91818b020efedb4b2346fe505b08
SSDEEP 3:MsEllllkEthXllkl2zEat:/M/xT02zZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f572e60b5120ac3550cb82919ed24de39b2e25f010c3d62b27f68f5e74fb4d9
MD5 ece21d68ccea5c41dc9ccec013b5eb8e
SHA1 7474cdf25ec7a41e166e95316825150c0338ab1b
SHA512 f4290931cfe20ce01eef45e2f9dd4ce78fbbdd92cecbe8346542cb7e8caaded842dbf24a03b2cdf5e8c7faa0a0eadab44390da3cb3bf0ddad2077a39a3a8f608
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 974e504bfedff07b1a8adb09c25812d94220ce68ad82ec9ae1b4519dcb2837aa
MD5 0b4e6f879d0896db07dacb9d2c7cd79d
SHA1 e21e210b04a47d9966d8043e666fc81f87391f40
SHA512 2d2604eb4cc824bec1fa993e4e98c3c3c6d82f4b847bc72e43b5f5e388fced903828c66da710cea5804adfe6ef87149e23ef59594b556992c3ce90e2e761fad8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 ee31d65bbecb2c9c414a3320ed5f059a93df6b4afc80c916d8bdaaad96eb9742
MD5 4394ed2287527116916a32ce91180c97
SHA1 a19c320a76a8df6c5e0a3dcad198886ff591f66f
SHA512 4fdea601fea149db3c752bdd9d35bd97b7c87c7ca654625374e6ea69dd09f3824462abc34902b275218ed524e799379186fd3015faab217ce9f01bc2744efc68
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1ece28b7df9dfff6e776c5dd9c0fca3ac1439fa2914d4786e59e50e9a0464123
MD5 11e795b1975430661e581d7c730625ca
SHA1 e2c964c8408c07f120a57804cc813465de0e8d32
SHA512 bd794709ec9e74e5c616454a6be227e3205f20cada5558ce950316bf7fe972eaf074dc7770b46c3a464d4f37b3f851c7dd6ffbc503ab162f8535119b9a261140
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 89daeb7d85a502e8c446162c8ab09480cd2b7b1d06cc6372a8278772a7b66548
MD5 055bb3ffd5eb9d95323effcc3c372040
SHA1 f49f9656583c10f265b4f09415355f07523355f6
SHA512 9d1486efef395bf8e382bb07febc62b131a1dcd503afb6dd364765fd2cda25cbdd3f27c0df5295e8ae62317527b064f774c6dc6aa98efbb97a452e13296399cd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 cd4fb7be10d26b8e64626dc929b0ec5e6625084976d595e57a8ebb8e933794d5
MD5 7e348fae8ba9705a5afe514b4940f7d9
SHA1 5dde6a194eb0cc41cfd0f7fdbebc459740821d0f
SHA512 f6929e93ec7c8a62bdc814364bacd665768b454a392f8caf19080307f13d373ee0ccf4e86674705e19e89cca5a6256adbccd85e47cbe66b516fb0faa874687f4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 00d8a1b936646b076864d0640230dabcc7ee15dcd6502109e9d4103ad33490aa
MD5 a8e1c6e264f477c33134482c90f5f9a3
SHA1 e6bffab0dec9a5f3be4be33950d8c336f1c87695
SHA512 df39e0e1ad8f1103d73fd6f2178668bd2502b7cc9e49b6dd2576a42e10644ae11e9a17f21f4d8aea1c8d0f2d5cd4b7843828b03036b93ee62924560c7f6c1aaa
SSDEEP 96:BXQsXLcjXFkNkKIStO98iZRy7Di+6MsmdesskgA8jZaOTzbjVhYtjEsXt0/cg2VI:BgsbchsC8syy+FUkKRotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f7ee6501af3f0786bb811c8044b2341fd5ddcf35645c1c9f51c762a2e9330545
MD5 750f9873566ed7cf849b75433c40af24
SHA1 77fa9ea5bef83091a5872c87bc4312046bd87435
SHA512 687f9d8d392a63176645e03112510f085718662e5636b2e8b45808075ffa946ec2feda24f2c43eabe8a4edf307b364eddc8369ab32dd65f7dd7b15eb91973fd4
SSDEEP 96:BXQsXLcjXFkNkKIStO98iZRy7Di+6Msmde2knMFLuOTzbjVhYtjEsXt0/cg2Vup:BgsbchsC8syy+FlknibotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 28d57a540159a714ec1fd2ed07bce6e57164c48ac3986fb38bc9f410368e3a92
MD5 1e274844b2d0d2b7b84b9388aa6ac8e0
SHA1 6142719f17a924f5d025ebae7bc59e1a45306dd3
SHA512 0af5a0ba1b311a5d5fa28ab066c6032965c3962bda313a23f2327f323e6b9a24034b414f562723b957d00b0ba89e753f7dd17552e9addfcb7530f1ecfb82b27a
SSDEEP 192:BgsbchsC8syy+FhFCkym3k+2lotjEsXtScPS:BgFjyxnWmV2mtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 1eb410a694cdcf139a34f0b7b844e195e2520e31b880d0c43f3da5365b6d6f35
MD5 c89f8ad540f4d3cf715ea81c0dac861b
SHA1 e29a3b683966d5a61444ff4c172f052b362ee6a0
SHA512 a092587194a83a2fd0b4bfc5045f1974ed6649085cbf33e2ca690d0c83c4c0fff650c4591954141871da598e19c11123034731d6020e6934377a38df42d71965
SSDEEP 192:BgsbchsC8syy+FgO7FCkym3k+212tjEsXtScPS:BgFjyxgEWmV2otIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 6a3e70d18ac1f625fe7e291e3fbf80a0ff55a5139b6a8d0da7e1dbf06b527c76
MD5 b4b548c446815062dbf8dc2192eb707b
SHA1 341f711b0ad4b8df7bfeb039509067cd9fdaa212
SHA512 8162330db407867281cc8cc53e7c6403d80cf343961fd3bca897eee8c8bde7d27ec93ff1a411e5948e4e28f24a5552adfa1199456dc2506e275e3cac14500617
SSDEEP 96:BXQsXLcjXFkNkKIStO98iZRy7Di+6Msmde0IOTzbjVhYtjEsXt0/cg2Vup:BgsbchsC8syy+FVJotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 c15d9e9e8e4800401e2a9857fb528f7d19107dac041c4c48776042be6069b86c
MD5 76ef8cb67810d255951cd3e68580e15e
SHA1 766944f6a1426d1b88db685141734b0da6dc85d7
SHA512 bbe92ad2b5ac563fc95c038230c2b277a30c0fa8dbe61711c78a8bf388917cf82c810d95ff1fcfd8d17794d40f0f8e59431394abff0d2fc32143c5941ecacf43
SSDEEP 384:XQ+LPLeWX51kXqKf/pUZNCgVLH2HfkArULmHG+gzSvPBQi:A+LPLL51kXqKf/pUZNCgVLH2HfTrULGN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 9f3754e131359ee005473006a2850dd8f76f530250d0340c12d5224f6dafc170
MD5 76a6d6b3b449515a2373a7e4d1ec9a5c
SHA1 7e64715bb7f1d8f5a49cbf43883732a2b1fa460a
SHA512 e226bbc6a3235eb6cc9b43787d0d6cff91bbd4c7b05e3a688bb017cefcc669ec000541d6049ad1da421c91db37ac637f5a559b66df701d66a59c99b8dd293823
SSDEEP 6144:MeUn8L9ta/pnxGrtp3reVm9mC/u/J8d4KwpfWjedbQ:2n8L9ta/pshp3S09mC/8JhKIfWKdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 bdcc03f86a507bbd5fab93a1d53a628014059c59714bb0b2eca2f9ddb8f2b27f
MD5 c756e5b954db87147948bdb9fd5bc737
SHA1 8e599060d7b2841ca8f66356f3fb694f93ecf6ab
SHA512 581c0a0dd77685cafdc4714a8c27185b70a624e9da797bbd5962e5784b0ae3d0a54477182fefa8e0af50f5e1a38fafe5e9efc4ac42cd92c4bcb1f4cc09c63f33
SSDEEP 6144:MeUn8L9ta/pnxGrtp3reVm9mC/u/J8d4KwpfWjedbQ:2n8L9ta/pshp3S09mC/8JhKIfWKdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

memory/396-17-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-9-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-16-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-19-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-18-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-14-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-13-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-15-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-7-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/396-8-0x000001A59D5E0000-0x000001A59D5E1000-memory.dmp

Download

memory/3552-6-0x0000000001160000-0x0000000001197000-memory.dmp

Download

memory/3552-5-0x0000000000EE0000-0x0000000000F11000-memory.dmp

Download

memory/3552-2-0x0000000001160000-0x0000000001197000-memory.dmp

Download

memory/3552-1-0x0000000000EE0000-0x0000000000F11000-memory.dmp

Download

memory/3552-442-0x0000000001160000-0x0000000001197000-memory.dmp

Download

memory/5104-0-0x00000000005F0000-0x00000000005F7000-memory.dmp

Download