Overview
overview
1Static
static
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...l.html
windows10-2004-x64
1OEBPS/Text...e.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text/3-TOC.html
windows10-2004-x64
1OEBPS/Text...e.html
windows10-2004-x64
1OEBPS/Text...d.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...0.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...5.html
windows10-2004-x64
1OEBPS/Text...6.html
windows10-2004-x64
1OEBPS/Text...2.html
windows10-2004-x64
1OEBPS/Text...3.html
windows10-2004-x64
1OEBPS/Text...4.html
windows10-2004-x64
1OEBPS/Text...5.html
windows10-2004-x64
1OEBPS/Text...6.html
windows10-2004-x64
1OEBPS/Text...7.html
windows10-2004-x64
1OEBPS/Text...8.html
windows10-2004-x64
1OEBPS/Text...9.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text...s.html
windows10-2004-x64
1OEBPS/Text...1.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text...t.html
windows10-2004-x64
1OEBPS/Text/cover.html
windows10-2004-x64
1Analysis
-
max time kernel
1799s -
max time network
1686s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-es -
resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
08-03-2024 19:11
Static task
static1
Behavioral task
behavioral1
Sample
OEBPS/Text/1-Cover-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral2
Sample
OEBPS/Text/1-Cover-2.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral3
Sample
OEBPS/Text/1-Cover-3.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral4
Sample
OEBPS/Text/1-Cover-4.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral5
Sample
OEBPS/Text/10-HH-Legal.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral6
Sample
OEBPS/Text/11-eBook-license.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral7
Sample
OEBPS/Text/2-Backlist.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral8
Sample
OEBPS/Text/3-TOC.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral9
Sample
OEBPS/Text/4-Title-Page.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral10
Sample
OEBPS/Text/5-Primarchs-Legend.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral11
Sample
OEBPS/Text/6-Primarchs-Content-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral12
Sample
OEBPS/Text/6-Primarchs-Content-10.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral13
Sample
OEBPS/Text/6-Primarchs-Content-11.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral14
Sample
OEBPS/Text/6-Primarchs-Content-12.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral15
Sample
OEBPS/Text/6-Primarchs-Content-13.html
Resource
win10v2004-20231215-es
windows10-2004-x64
Behavioral task
behavioral16
Sample
OEBPS/Text/6-Primarchs-Content-14.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral17
Sample
OEBPS/Text/6-Primarchs-Content-15.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral18
Sample
OEBPS/Text/6-Primarchs-Content-16.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral19
Sample
OEBPS/Text/6-Primarchs-Content-2.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral20
Sample
OEBPS/Text/6-Primarchs-Content-3.html
Resource
win10v2004-20231215-es
windows10-2004-x64
Behavioral task
behavioral21
Sample
OEBPS/Text/6-Primarchs-Content-4.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral22
Sample
OEBPS/Text/6-Primarchs-Content-5.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral23
Sample
OEBPS/Text/6-Primarchs-Content-6.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral24
Sample
OEBPS/Text/6-Primarchs-Content-7.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral25
Sample
OEBPS/Text/6-Primarchs-Content-8.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral26
Sample
OEBPS/Text/6-Primarchs-Content-9.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral27
Sample
OEBPS/Text/6-Primarchs-Content.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral28
Sample
OEBPS/Text/7-Josh-Reynolds.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral29
Sample
OEBPS/Text/8-Extract-1.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral30
Sample
OEBPS/Text/8-Extract.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral31
Sample
OEBPS/Text/9-Newsletter-advert.html
Resource
win10v2004-20240226-es
windows10-2004-x64
Behavioral task
behavioral32
Sample
OEBPS/Text/cover.html
Resource
win10v2004-20240226-es
windows10-2004-x64
General
-
Target
OEBPS/Text/3-TOC.html
-
Size
3KB
-
MD5
a9da8117343ff448b17ed99f5c7693d0
-
SHA1
05c39cd79728563819d57bb5431f4a06c43ad45b
-
SHA256
4fc9c20b47654ee2ef2af0fc435bd5a34423e62a5440461d94f3465334b9d60d
-
SHA512
5a8b791f44b2eb5692c4be302ee01fb8cb2c3d981cc2c66f3d28b42abc2086c7565c3a2bf3520de087d539d0e4eae03eb32b9d03d506d9df33ea20c421a74378
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544014362043248" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe 3472 chrome.exe 3472 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1456 wrote to memory of 2484 1456 chrome.exe 88 PID 1456 wrote to memory of 2484 1456 chrome.exe 88 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 4136 1456 chrome.exe 93 PID 1456 wrote to memory of 856 1456 chrome.exe 94 PID 1456 wrote to memory of 856 1456 chrome.exe 94 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95 PID 1456 wrote to memory of 4192 1456 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\3-TOC.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2c379758,0x7ffd2c379768,0x7ffd2c3797782⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:22⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:82⤵PID:856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:82⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:12⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:82⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:82⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1832,i,2897192718362575829,1211255292698197007,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3472
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\94710cd4-69fb-43ad-af7d-4fa0f06514bd.tmp
Filesize6KB
MD57612697b69a810e15f2ec68e63ee439e
SHA1e4b62bf3a4336c7cc753c9c07a6365d0f2f2d06a
SHA2566a127d5d8e541be567bc510579e4ee8924c8942f6b385c5f93ef5a8c0d295ee6
SHA5127f664fd07d22552a1767f87725d2e872535e369ea3a20da85cfe6446ee6ce83d4381606a8d7bcace3e19c6608b4c6955c70a4dadfb1df289614a983396dec7f5
-
Filesize
6KB
MD52c2d8e916ffff9bf0ab3d303f74a340a
SHA14689815eb6eaf174f1b2565ac780ee609f2017d6
SHA2563f83f45d5e13aaf791196f95197e490d9c511d33079d211fd1b7b72b96eee95e
SHA5123acf93776d6d9bbf5fd0213674c3075afc240364fdc780e4fd3d79da6a73fb6967c845c281b6a8edbd756a3a7d34fbc4ff7b852240b8d4e90abb35fc845d7d1b
-
Filesize
253KB
MD5a2cbed9361289015083f2fd767189f90
SHA11e968262989ac6da20714d3fb0640ef1cb29ec9a
SHA25638a7536b5c9d70cfbad50e58f0a41ba37fbc1c462a86a9da4b16049856b5ccbe
SHA5122296e281448345aedea414611cedffe26b4ae2c45aad83d8459f8261859a296e140463597f045fd704c05e278cddc3717edc841ff5e4febcd428b9adf924a371
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd