Overview
overview
7Static
static
1Ragib's We...ct.zip
windows10-2004-x64
1Ragib's We...t.html
windows10-2004-x64
1Ragib's We...UT.txt
windows10-2004-x64
1Ragib's We...me.css
windows10-2004-x64
7Ragib's We...in.css
windows10-2004-x64
7Ragib's We...me.otf
windows10-2004-x64
7Ragib's We...nt.eot
windows10-2004-x64
3Ragib's We...nt.xml
windows10-2004-x64
1Ragib's We...nt.ttf
windows10-2004-x64
7Ragib's We...t.woff
windows10-2004-x64
3Ragib's We....woff2
windows10-2004-x64
3Ragib's We...d.less
windows10-2004-x64
3Ragib's We...d.less
windows10-2004-x64
1Ragib's We...e.less
windows10-2004-x64
3Ragib's We...h.less
windows10-2004-x64
3Ragib's We...e.less
windows10-2004-x64
3Ragib's We...s.less
windows10-2004-x64
3Ragib's We...r.less
windows10-2004-x64
3Ragib's We...t.less
windows10-2004-x64
3Ragib's We...s.less
windows10-2004-x64
3Ragib's We...h.less
windows10-2004-x64
3Ragib's We...d.less
windows10-2004-x64
3Ragib's We...r.less
windows10-2004-x64
3Ragib's We...s.less
windows10-2004-x64
3Ragib's We...d.scss
windows10-2004-x64
3Ragib's We...h.scss
windows10-2004-x64
3Ragib's We...r.scss
windows10-2004-x64
3Ragib's We...s.scss
windows10-2004-x64
3Ragib's We...d.scss
windows10-2004-x64
3Ragib's We...d.scss
windows10-2004-x64
3Ragib's We...e.scss
windows10-2004-x64
3Ragib's We...x.html
windows10-2004-x64
1Analysis
- max time kernel
300s - max time network
274s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2024, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
Ragib's Website Project.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Ragib's Website Project/about.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ragib's Website Project/font-awesome-4.7.0/HELP-US-OUT.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Ragib's Website Project/font-awesome-4.7.0/css/font-awesome.css
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ragib's Website Project/font-awesome-4.7.0/css/font-awesome.min.css
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Ragib's Website Project/font-awesome-4.7.0/fonts/FontAwesome.otf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ragib's Website Project/font-awesome-4.7.0/fonts/fontawesome-webfont.eot
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Ragib's Website Project/font-awesome-4.7.0/fonts/fontawesome-webfont.xml
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ragib's Website Project/font-awesome-4.7.0/fonts/fontawesome-webfont.ttf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Ragib's Website Project/font-awesome-4.7.0/fonts/fontawesome-webfont.woff
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ragib's Website Project/font-awesome-4.7.0/fonts/fontawesome-webfont.woff2
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Ragib's Website Project/font-awesome-4.7.0/less/animated.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ragib's Website Project/font-awesome-4.7.0/less/bordered-pulled.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Ragib's Website Project/font-awesome-4.7.0/less/core.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ragib's Website Project/font-awesome-4.7.0/less/fixed-width.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Ragib's Website Project/font-awesome-4.7.0/less/font-awesome.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ragib's Website Project/font-awesome-4.7.0/less/icons.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Ragib's Website Project/font-awesome-4.7.0/less/larger.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ragib's Website Project/font-awesome-4.7.0/less/list.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Ragib's Website Project/font-awesome-4.7.0/less/mixins.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ragib's Website Project/font-awesome-4.7.0/less/path.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Ragib's Website Project/font-awesome-4.7.0/less/rotated-flipped.less
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Ragib's Website Project/font-awesome-4.7.0/less/screen-reader.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Ragib's Website Project/font-awesome-4.7.0/less/variables.less
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/_bordered-pulled.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/_fixed-width.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/_larger.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/_mixins.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/_rotated-flipped.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/_stacked.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Ragib's Website Project/font-awesome-4.7.0/scss/font-awesome.scss
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Ragib's Website Project/index.html
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target Ragib's Website Project/index.html
- Size 3KB
- Sample240308-x5b4paed64
- SHA256 3b47916d148fe049fe036ec096156112090a02dac36b4d5dd8fb704e0a35a104
- MD5 f6288f1be97264a213bb2ffa543fa093
- SHA1 e1bcdfca6170e9b3fe187a0d5e530b82ceeeb5ba
- SHA512 c7f6021c2e6974143b3f307887d89e5b22115d36b657f1300403c195dcce76e3d294e2e4e7cac1c1d4fed21279bcd798828a76a132b4cf8736a113b5305ae08a
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543995856839297" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 4300 chrome.exe 4300 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 5060 5092 chrome.exe 89 PID 5092 wrote to memory of 5060 5092 chrome.exe 89 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 4600 5092 chrome.exe 91 PID 5092 wrote to memory of 1956 5092 chrome.exe 92 PID 5092 wrote to memory of 1956 5092 chrome.exe 92 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93 PID 5092 wrote to memory of 4204 5092 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Ragib's Website Project\index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb261d9758,0x7ffb261d9768,0x7ffb261d97782⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:22⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:82⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:12⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:12⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:82⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:82⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 --field-trial-handle=1884,i,13814005016901605314,1487874430784060029,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 a362cfcbdaa425a977c61eee8b90da52aaccf333915cbdd6c435bebceecc3094
- MD5 04b71499703f37718fb0d6efefe23957
- SHA1 12b8329adac8562a052f779a6aa26786f26b1ba7
- SHA512 0e6c6ea0357a6e9538b0642ca2401cb92b61a68acaf865d6d802c46f411c76b63f5454e1b2925b8e4dfc85d5b25dc87da3f18f454a528b1261b69d190361d41e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 538B
- SHA256 eb439e8f2b11db3616aaba694fef7b6b033b387b2b924d35934aef896473d4c7
- MD5 85ecfbdfb9f36bd3a867b442d7398faf
- SHA1 10ee66a5a26e7acd2ca9f65a25d9ad07c545abf6
- SHA512 9089612fd505678e429177a21c93ef3d62ff5cf03f346f584be73f7631eec2e72d0ac0164f7a90d650cb1ab6b87e224aba5ada25174bbdb9b698d8e9bbc8f450
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 d32857c2664c6c076c2c9b11c124bfdd2c31ab71ad18937823ff0b2470f9c7e3
- MD5 2d2406ec130a6626e73cf1b2a8fccaf8
- SHA1 a7c888c6244ca0fcc0f961f973e14bb6c8bfc7e5
- SHA512 ecb9b0667d3ccf4ac273ecdbe7e76209e45142bb1971696868eab4b73eb6674c7667c24d4f7b6f0817ed8fae163805cd6eb944f720ea79e1ed5ac05395c00d9e
- SSDEEP 96:xZq/X8MKIqwl8iZRy7Di+6MsmdeLOidAlkjVhYtjEsXt0/cg2Vup:xs/boG8syy+FDlkotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b082d5ff-cf18-44d0-8453-be3c373033d1.tmp
- Size 6KB
- SHA256 b5a5d235750cf7a2f4d5639813ec4ccfad948b670ae8ad85415337d1c9f95287
- MD5 a75439faa31caef80e8225bd4a343782
- SHA1 a8f4244498d6dfbf9b33a42cc81aab524e0fce81
- SHA512 ba6c0b046f1661df8c25ae9d87cfff682ebb4e4142c0054d9e9ef67639b719375eecca1d82ddcf552e52b54e0e2eaa3f58222f720ecf9ce0e6827068503799cf
- SSDEEP 96:xZq/X8MKIqwl8iZRy7Di+6MsmdeXIOidAlkjVhYtjEsXt0/cg2Vup:xs/boG8syy+FuVlkotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 b7c4b87b6656e2c37244cf990ef4b641bdec7cfdb24d918d98dc8de4d0019250
- MD5 1a497f3db5ed04dda97db0b45190d1c6
- SHA1 1dea27270e938a38721b6d344c23792e86ba6dee
- SHA512 70bc19913074787ada74db9eeac35f3a9e7ed38595d667d4961b97dea56bc6bbabc6831e5f54765f6e55ae3c4c94e9d8e124717477440a380da0296a5d6048d9
- SSDEEP 3072:Q4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+Zf:DASNdvXCNpbMHtCMpS/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512