Overview
overview
1Static
static
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...l.html
windows10-2004-x64
1OEBPS/Text...e.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text/3-TOC.html
windows10-2004-x64
1OEBPS/Text...e.html
windows10-2004-x64
1OEBPS/Text...d.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...0.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...5.html
windows10-2004-x64
1OEBPS/Text...6.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...5.html
windows10-2004-x64
1OEBPS/Text...6.html
windows10-2004-x64
1OEBPS/Text...7.html
windows10-2004-x64
1OEBPS/Text...8.html
windows10-2004-x64
1OEBPS/Text...9.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text...s.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text/cover.html
windows10-2004-x64
1Analysis
-
max time kernel
1800s -
max time network
1686s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-es -
resource tags
arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
08-03-2024 19:11
Static task
static1
Behavioral task
behavioral1
Sample
OEBPS/Text/1-Cover-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral2
Sample
OEBPS/Text/1-Cover-2.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral3
Sample
OEBPS/Text/1-Cover-3.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral4
Sample
OEBPS/Text/1-Cover-4.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral5
Sample
OEBPS/Text/10-HH-Legal.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral6
Sample
OEBPS/Text/11-eBook-license.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral7
Sample
OEBPS/Text/2-Backlist.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral8
Sample
OEBPS/Text/3-TOC.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral9
Sample
OEBPS/Text/4-Title-Page.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral10
Sample
OEBPS/Text/5-Primarchs-Legend.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral11
Sample
OEBPS/Text/6-Primarchs-Content-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral12
Sample
OEBPS/Text/6-Primarchs-Content-10.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral13
Sample
OEBPS/Text/6-Primarchs-Content-11.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral14
Sample
OEBPS/Text/6-Primarchs-Content-12.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral15
Sample
OEBPS/Text/6-Primarchs-Content-13.html
Resource
win10v2004-20231215-es
windows10-2004-x64
Behavioral task
behavioral16
Sample
OEBPS/Text/6-Primarchs-Content-14.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral17
Sample
OEBPS/Text/6-Primarchs-Content-15.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral18
Sample
OEBPS/Text/6-Primarchs-Content-16.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral19
Sample
OEBPS/Text/6-Primarchs-Content-2.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral20
Sample
OEBPS/Text/6-Primarchs-Content-3.html
Resource
win10v2004-20231215-es
windows10-2004-x64
Behavioral task
behavioral21
Sample
OEBPS/Text/6-Primarchs-Content-4.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral22
Sample
OEBPS/Text/6-Primarchs-Content-5.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral23
Sample
OEBPS/Text/6-Primarchs-Content-6.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral24
Sample
OEBPS/Text/6-Primarchs-Content-7.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral25
Sample
OEBPS/Text/6-Primarchs-Content-8.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral26
Sample
OEBPS/Text/6-Primarchs-Content-9.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral27
Sample
OEBPS/Text/6-Primarchs-Content.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral28
Sample
OEBPS/Text/7-Josh-Reynolds.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral29
Sample
OEBPS/Text/8-Extract-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral30
Sample
OEBPS/Text/8-Extract.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral31
Sample
OEBPS/Text/9-Newsletter-advert.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral32
Sample
OEBPS/Text/cover.html
Resource
win10v2004-20240226-es
windows10-2004-x64
General
-
Target
OEBPS/Text/6-Primarchs-Content-3.html
-
Size
36KB
-
MD5
9cc5aeb880ade00b2088893f2f492068
-
SHA1
abbb15cbfd49ba9a284807a8bebdea0df8912b2e
-
SHA256
939b8bc4ad793eb3da009542f62c916945a8e315868415814105a17e2aa5cd31
-
SHA512
226fd4ba0138dcdd9974be816f055d74ea1ff8f3b81ebc904f0ded1ef7312a39772256f0da2deb357a72756159b3e22130c99e686b689f8a63f951ddea13189e
-
SSDEEP
768:P+eTYCx+r4n44kK/kmXVrWqg24xf7bFecyjZsYen:PNTT+r41f5RE7ccIsT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544016802451329" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3948 chrome.exe 3948 chrome.exe 3992 chrome.exe 3992 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3948 chrome.exe 3948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe Token: SeShutdownPrivilege 3948 chrome.exe Token: SeCreatePagefilePrivilege 3948 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe 3948 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4040 3948 chrome.exe 85 PID 3948 wrote to memory of 4040 3948 chrome.exe 85 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 3332 3948 chrome.exe 87 PID 3948 wrote to memory of 2092 3948 chrome.exe 88 PID 3948 wrote to memory of 2092 3948 chrome.exe 88 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89 PID 3948 wrote to memory of 3920 3948 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\6-Primarchs-Content-3.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd85ef9758,0x7ffd85ef9768,0x7ffd85ef97782⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:22⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:82⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:82⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:12⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:12⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:82⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3856 --field-trial-handle=1788,i,7380955670798604744,3878940683272955862,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3992
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823B
MD5526867646f2f43a50e2af9fdf38df542
SHA1e72ed90c1c5ec9fe0e9e147a1d563cc9ef7407fc
SHA256aa3a1c9e89e341be49aa430f8eae7bd316a1a6c8c6dd3d53b321c9da9e2579bb
SHA5125ede0fe32d511f271760dc8009a66ea7c26ad6ad73f267478a68539dbfaa03d7c5faa9f034e2fb3e37ea1f11e6228b348b47bc89649e1a703e658d823ae3239a
-
Filesize
6KB
MD5b1c1ad59fb35b21a49819cf25f550524
SHA17ded96451a799e5da521caa9f54fe8f38d45feeb
SHA256d12e85f87148f73fab704f36ab86cecfd6e76f827b0709aff3f9e94a06333227
SHA512640144aae8c0a3cb87729dbe8fb8b1b30dd444c4b58ec621617d2bf08bd967fa3e1b8d95dcae59a2d58fc8ea5771daf467b6dac794d53d0aa935444862a18f08
-
Filesize
6KB
MD5ebd2ada7092615c49a024e87eb7150c8
SHA120e80a25ad51f9eb1f39e808f751942e6e37caad
SHA256d1be833111c2e44738b2f2ff718a38a1eef9c08d84a13488d7bb1bd87bef5ef0
SHA51268530d001ca91b08affc536e27bc0cbaa2fffb53b75eba8235b4f7962e94ceeaa9a870d71111cdb39a7ea7b187d28e7780d1d8b2121a031d0c8f933b519078e2
-
Filesize
114KB
MD55731004688791032a881ef63ca39418c
SHA14c1cf858430e536c3247253f8cbd84e4aea1d018
SHA256aae21633f294080e61328ce8ff7bf2cef331cf09725bf454d1493fe60f2ead7b
SHA512cf01201704923cd3070ef66911c3c7103d0520eeebea10bbf646fdff8c21972a16369feba81fbc0c6df3ab5e4430c0ecde06d6fbe78b2ff94fc26130b6f4e20d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd