Overview
overview
1Static
static
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...l.html
windows10-2004-x64
1OEBPS/Text...e.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text/3-TOC.html
windows10-2004-x64
1OEBPS/Text...e.html
windows10-2004-x64
1OEBPS/Text...d.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...0.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...5.html
windows10-2004-x64
1OEBPS/Text...6.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...5.html
windows10-2004-x64
1OEBPS/Text...6.html
windows10-2004-x64
1OEBPS/Text...7.html
windows10-2004-x64
1OEBPS/Text...8.html
windows10-2004-x64
1OEBPS/Text...9.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text...s.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text/cover.html
windows10-2004-x64
1Analysis
-
max time kernel
1805s -
max time network
1806s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-es -
resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
08/03/2024, 19:11
Static task
static1
Behavioral task
behavioral1
Sample
OEBPS/Text/1-Cover-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral2
Sample
OEBPS/Text/1-Cover-2.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral3
Sample
OEBPS/Text/1-Cover-3.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral4
Sample
OEBPS/Text/1-Cover-4.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral5
Sample
OEBPS/Text/10-HH-Legal.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral6
Sample
OEBPS/Text/11-eBook-license.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral7
Sample
OEBPS/Text/2-Backlist.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral8
Sample
OEBPS/Text/3-TOC.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral9
Sample
OEBPS/Text/4-Title-Page.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral10
Sample
OEBPS/Text/5-Primarchs-Legend.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral11
Sample
OEBPS/Text/6-Primarchs-Content-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral12
Sample
OEBPS/Text/6-Primarchs-Content-10.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral13
Sample
OEBPS/Text/6-Primarchs-Content-11.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral14
Sample
OEBPS/Text/6-Primarchs-Content-12.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral15
Sample
OEBPS/Text/6-Primarchs-Content-13.html
Resource
win10v2004-20231215-es
windows10-2004-x64
Behavioral task
behavioral16
Sample
OEBPS/Text/6-Primarchs-Content-14.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral17
Sample
OEBPS/Text/6-Primarchs-Content-15.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral18
Sample
OEBPS/Text/6-Primarchs-Content-16.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral19
Sample
OEBPS/Text/6-Primarchs-Content-2.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral20
Sample
OEBPS/Text/6-Primarchs-Content-3.html
Resource
win10v2004-20231215-es
windows10-2004-x64
Behavioral task
behavioral21
Sample
OEBPS/Text/6-Primarchs-Content-4.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral22
Sample
OEBPS/Text/6-Primarchs-Content-5.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral23
Sample
OEBPS/Text/6-Primarchs-Content-6.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral24
Sample
OEBPS/Text/6-Primarchs-Content-7.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral25
Sample
OEBPS/Text/6-Primarchs-Content-8.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral26
Sample
OEBPS/Text/6-Primarchs-Content-9.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral27
Sample
OEBPS/Text/6-Primarchs-Content.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral28
Sample
OEBPS/Text/7-Josh-Reynolds.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral29
Sample
OEBPS/Text/8-Extract-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral30
Sample
OEBPS/Text/8-Extract.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral31
Sample
OEBPS/Text/9-Newsletter-advert.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral32
Sample
OEBPS/Text/cover.html
Resource
win10v2004-20240226-es
windows10-2004-x64
General
-
Target
OEBPS/Text/8-Extract-1.html
-
Size
41KB
-
MD5
beed5dd6f6651e6e515eeca32b772c4e
-
SHA1
5c957efcd792efb679122d7d33785ef4a097a35d
-
SHA256
6026e0d85658dde24c552876f54d34011947928d92143bc9c98cc5129844ca00
-
SHA512
d8e608bb0a7a8bee0a66185709966f955359c68210d616ffeea412684e072d09368a2115d54a504dd04a5fc488de226c318e9a32fe3e1aa75770224a25148805
-
SSDEEP
768:PI34W9ilFd8PzSASmpjIynlOJHXneFiFSJ0uVd3PFMuA/aj:P49ip8rSASmhHl6eFwuVdgaj
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544020329782024" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1964 chrome.exe 1964 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeCreatePagefilePrivilege 1424 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2564 1424 chrome.exe 97 PID 1424 wrote to memory of 2564 1424 chrome.exe 97 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 4608 1424 chrome.exe 99 PID 1424 wrote to memory of 2444 1424 chrome.exe 100 PID 1424 wrote to memory of 2444 1424 chrome.exe 100 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101 PID 1424 wrote to memory of 900 1424 chrome.exe 101
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\8-Extract-1.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdbcdf9758,0x7ffdbcdf9768,0x7ffdbcdf97782⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:22⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:82⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:82⤵PID:900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:12⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:12⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:82⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3692 --field-trial-handle=1904,i,13397567695456909276,1949998975694481413,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5844 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:81⤵PID:5788
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2452 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:81⤵PID:5352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5af3d1cfc1e67826d1fc41a1d2993fc93
SHA16dcf0c311f71db6b3fbcec699b22704a38239684
SHA25631450bf858f7a70ab5c5fb0ff04dd2181a18d5f6d5a24e0ecbb353d79ab84aaa
SHA512f9d3a3e672058f2c2a266abf3024ada103dd06432fa419480e1ba8f6d306966dc1b389758949a26bd5bdaadacb1cdad3d31a915517e42db1a9b8b60d18d85c09
-
Filesize
5KB
MD55780a7cb6b2534bfecf21972acbd49ee
SHA14ee42da3f639dfeb40e28b50e3b9d0fb0f04dd8f
SHA256b640a5b1821edcfc84851c9564bd930c51f60aa93ef154be1c10cc0995c28a43
SHA512a6eb5a5fdb83348facc2b396dfd9fe6e2285b184f64ef17063609d0695fb13e4a5eda9a6a2b4111e2dbf4f145fede199f08e477d5712bb37a86083d4bf8359be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e080c6ad-0204-4cfd-a011-143a979f642e.tmp
Filesize5KB
MD5d04ecf00c0462623db1d89be0f3c6f90
SHA1e3f318d7715400c26c16515d1dc6701a0fc653b8
SHA2566ee670d01f73d77b3f040bf33a2750e95f0991f722818b64914fb8d2557a8a62
SHA512fd851260d7d1fe26aea5798d72af645e67ca9bf73bf27f40097c34da30c3c3088b0ffafe54def24fece4a021435002f7907e0eae6c44efdbf8e6e86827f5e10a
-
Filesize
253KB
MD549c03845654b388f3424a7527cf04830
SHA1a0613d5713f000c5927eb4ef5bee3a59776ec9c6
SHA25608df19c0f35a76ce878e17ee4b3517a763b65f257e73d1c163285c9fd1cb525b
SHA51276f21be14e8500b4a7d75a0419cc03a776b14f2bb5dae86c21f6001e39ecced12ed3542ed490fc41e8c65dceebe6bd5d833a07c49045c11c19b43d018fd3a9ea
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd