cc45bd67c37538a1b0e6f28effd1b0fdd1bfd8878e0c3fce91829665890121cf

max time kernel
959s
max time network
896s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
11/03/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webhook
Size 125B
Sample240311-d22qdsbb49
SHA256 cc45bd67c37538a1b0e6f28effd1b0fdd1bfd8878e0c3fce91829665890121cf
MD5 52f5ca250742304c2ae82d485db06bd9
SHA1 5c0253f78cded713916f7818a9d41d0b6c277fa8
SHA512 0a39a6fa953092d4b341ddd7db318662f90c9db3d5cf8e273dfbf6f41b1314fca0f9957eacb6fe8efc1aaf776c34dc3d99230cc024b0b90db223ef84f93f9bfe
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133546015504215963"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2452	2380	chrome.exe	74
PID 2380 wrote to memory of 2452	2380	chrome.exe	74
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 672	2380	chrome.exe	76
PID 2380 wrote to memory of 720	2380	chrome.exe	77
PID 2380 wrote to memory of 720	2380	chrome.exe	77
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78
PID 2380 wrote to memory of 4348	2380	chrome.exe	78

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\webhook
1⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff83ef09758,0x7ff83ef09768,0x7ff83ef09778
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:2
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2364 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2524 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4600 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5032 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3344 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4548 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5128 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4812 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=968 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4784 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5364 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=996 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 --field-trial-handle=1848,i,10663428599636071504,9087560693972568833,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 700397952d18423ff173a5b9ad98d57850bc7e668acd5c3e87bee58222d3f36a
MD5 b7a149638bc4655bd51f0f7b1fa612a8
SHA1 136d977dbe4ef11018a295c595a362a022eb634c
SHA512 ad47828bcb05160ffb813a1534d27d86a35c538481d9c40efeba90271eeab96ae3b2a67ef74d19563357466ef3ef528c93c53fad9f41f6cf9b1e944836620696
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f9883648077cfdc7096df62438a31fe186230f128de3caa8c5b8fa4f644faab
MD5 0d352f723de52f5ec196c71aaa2412fa
SHA1 c05dc979cc2c1a086eee130d3a9ad7d469a522ae
SHA512 3f92831770c68587168aa0fdf795558265ed7bc620a3b1117134aa7e3175d9bf635894eb97ff4653947319293fd5ffe7878a9a76b3586b2109d916cfa59f3c69
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 934f3a1e124574aed3a404f9bb5f73ac5d6ce20b95af6499105559863f115d9a
MD5 db51499d4dc3941dc8d5faffd7295f12
SHA1 c6e4452ac42f98caa08d0abef922561b40a2bdb5
SHA512 613351fd3aacdc7e17c8282c2338b1d04c705b11fb827eb908507e7ba5f4a40adca7bc62b6d351758f5fa311ae9dfca60cc1e5a3ea0756e260b7dd241035525f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fae980d63b29dd3c9c7d6fffdd73f9cf0cce4c658502f6516df3ed657046a88
MD5 8f84e8c0f150af1798dfc3436f54266a
SHA1 9baf04a0dda4d1bd83a18a3d15dec64bc40112f9
SHA512 fe670861ce80a538ec95a3687aff6a61b4980c3dfbff9be3d465d3e02bed9b97932bdc7b7191ff5a25f638178594c881c55a90c56a65e0332e87193bad0e327f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 987B
SHA256 ea4e5b6cd70ae73e9ed0e8b31176f99de8844fba5f9543298b4739aeedceb412
MD5 9e8610c320ac3bf27b6e4ccd72bf8643
SHA1 024166c33d5c34a5bd73279261ee0c69eb4fa9da
SHA512 6cfca6f3f08cc105857990bad71f65eab09297634382285e1e6ec05ab062833875c2e4d13936db31857df821edc6890de6f1bbe8875635f065eee3b00a8b4494
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b415e6dac05af40810ad5357eb61ea8269be9ba39751d1d8deec8587cb8c69ad
MD5 8cff16aac7c00aa1b6aa122843f27e22
SHA1 526a72d163e1a6647dc6ffe2327fc22207f3fa54
SHA512 909e0cbe7842247cf991839e5aeeb32affb476ce02d46db8478372d6ab05df2782323213516040a9701ec106d07958597ae7cda5c15f09254c04166f4bca0edf
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 fb1f5e5ecdfec41274c901b04fa64030183d93538cb68d37c0a42b4dd54e88c1
MD5 59879621779b493d4ecaa5a6e2a66083
SHA1 9e7263d82ddd91e00cb685942fb9603988cb4f98
SHA512 899abc541252ac3dbaa44580ca4af43204d51ada7eaae783305dd1ce3c717760f5105dc094ef1f17c3a0918669953f2df6b84df3fa9ad93a9537b241024bd908
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3a90fd69f966af92faa813fa4474a443af3d8d6b767166e89868006e3499daf6
MD5 1ee7ff54f5dfaa39792e90093b18c482
SHA1 7418d94957da2cf80f48b08d932084040e206aab
SHA512 5d52c93166adbb7fa91b68ab51005c7ca650a427657bfc72f663475529a1bedba8a57cb4051786bf04b9708e64e77b859200ee1612a54a66f53d3b3f1a47115f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 538B
SHA256 74a4a4d30bc575328bee751008899e3e83547d8bb8bf96bf62f83d33a21f6fd2
MD5 350bf27c01fa46ef2172afbc3a2ea416
SHA1 d3d1a6c4f990b7c16e4a381a6712e3e36d2d1e1d
SHA512 4a173998945026b4d409ce3c2d77e7fabd24375a56fff5f025654b7d88bd1f2c6e1bd66e8ed8db2c731cad18388a140ae08fee2b4fd83d23a3bbf3326d71a96e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 1c28ea4b74b9d6e4ac56ff87aebc52caa8757e9bfcceecd16f11b47ae0778033
MD5 4588e8c2bcc13aa075e8c436ca172da9
SHA1 53b247fa18e4f5ea75a4f0f2ca7b57a5fd3a1ba3
SHA512 30eeb39a49a2b69dca4961872523131d0594ca5377dc62479ff2165b1d63db6a6edd40e1086682fc4b75f9ed253e86b88d504ad235820e340bbc26fdae61c15e
SSDEEP 192:UzllV/8syy+FmGDksATkD1SEX50hMjtjEsXtScPS:Uzll7yxm2A21SEX50hqtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 a69659f25cdc412d7ab9692ebc3b1d9d4e66f8db6d75b214572147095a02f4ef
MD5 dc1839157c382f3bbaac8b2a57924536
SHA1 3804c7f0a8e8a5eb7272a5f768e97dbc5e56a4fe
SHA512 970da5ab611abb6ab7309cadf2ecfa9464c7c1c56878d60b4f0d49ac02fd6728525409e69a8ab781aef011ceec46c80bb0c7bd2a9bba003978d4de4dff98ad56
SSDEEP 192:UzllV/8syy+FmGhkKOkD10EX50hMotjEsXtScPS:Uzll7yxmOT10EX50hvtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 3a42a09788300f31bcfec72ca2210a80d105d4a280e0d5eaea4692ade304689d
MD5 62ddb2833f27ba4599df027b5c4d846d
SHA1 a448ddb4f90dbd918bf3b096b32571309926964c
SHA512 12d34c6cae54670ec9d1a0fa547d788a6da8e84ffdbe53551e8b3107340e27edf1be50daea843f7c661da92a8e1e8f12dfd4ac6dbe8c631909d2ed915f291298
SSDEEP 96:SzlB6WVKIknFd8iZRy7Di+6Msmded0IOgkg0sg8TjVhYtjEsXt0/cg2Vup:SzllV88syy+FS0250hMotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 80fc8023c5d555752b13935463559a1f0968ae30dd2560306ba06667752cdedf
MD5 e53911ffedf76df3057c95122933c31b
SHA1 129a8825e35b761aba723ea027a0dd242a3ee3c8
SHA512 5b12e97de957ae595d648f064c8fe43da4babc4645c22ddb4e5e13cbf1ec4b5d0e04994ca014e56aaf8b1e66c2b496dd478adf74728d2c73f2959580b1473032
SSDEEP 192:UzllV/8syy+FmG7kA2kD1CEX50hMotjEsXtScPS:Uzll7yxm+L1CEX50hvtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 96a8f23eb678a858a2e1e32475fbd40e8170ff95b85152074f8a1b77ea87c178
MD5 30f6ebe642158a4d451b0282b77110ae
SHA1 bbc900d85e4384ca8a85f60e437ed59dd2e68a1c
SHA512 09334bb0ff9831f6fc263aa0b455cfdae06ce80c300da533b46358c1fdb6afa689968323041b27d5f42fd8cce5d24641f0f0c1e350bf80f079e63e1fb2535318
SSDEEP 192:SzllV88syy+FHkD1lEX50hMotjEsXtScPS:SzllEyxa1lEX50hvtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 0b31e2d3dba6ac15ab60dd59b26ca783c99b33251c32e28e5f653cce99397e62
MD5 f3acd0c148b0aab25d673cfede676f0c
SHA1 34374099bc2efa792ecd351da769d3f4a782a88f
SHA512 17a7825d5e0ddbbb0be2c600ae422de199e69c6cf2361a285f43edb8799e60ca58e2b19a62371a2f58c6ec308df858a60e22fdfa5c11d70d3ba7e246c9c29c71
SSDEEP 96:SzlB6WVKIknFd8iZRy7Di+6MsmdedZOgkg0sg8TjVhYtjEsXt0/cg2Vup:SzllV88syy+FS550hMotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 84c2d450677d61ca28fe2ddcea968bd80ac303fa8b8f292a2aeca7c7430e05b5
MD5 ec0a8eb5247af693247eb28042e1970d
SHA1 3630eee02a26e117f3a3a488449bc5e6ddb73820
SHA512 61c4c6c22c25003f0c7e36c99a0d38cbe845599a54bba73e9db91268079e554a4d303b85450a5892bd3861af0a137d0d68b33418256d59b58bf9957575807cdc
SSDEEP 6144:N5Ir0fBhiNtfbvPfdKzJui7m9XPnJ6d7Yj3Ua9jHThM8fNHK9K5B:Nc0WD4DQXBIsbUYHTqwNqo5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 82e32f8a278e6579af1040d8de55cf4ca8d27373f7a34bd448aabc89538a5d79
MD5 a49689438948cb119acda930ef5386e6
SHA1 8b98deb91acf376a86d33d529c5d4006ae7f8ca2
SHA512 308a08d0e926bc95ff7f097e0c21209e6a3a8ba3f96b7a7a7a1a2d13baf665d996e166c70a6c41b8a86d169948a10a052015633f94f2ed16f730e2568c718413
SSDEEP 6144:45Ir0fBhiNtfbvPfdKzJui7m9XPnJ6d7Yj3Ua9jHThM8fNHK9K5B:4c0WD4DQXBIsbUYHTqwNqo5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 102KB
SHA256 e9d6d8039084224ec28701ef16484c1ad153968676a478c561faf0862b30e4fb
MD5 6376e9dc4000112dfe9205389278e4fc
SHA1 204bcd9fc612a6588f35ce7779d59b217c0acdd8
SHA512 bf49007ef3c2db5f0ed015e509ab368d6e5dc450a947b1eb6ea62852f6cd429b8519d421f886622ff62140172f8a31e0f354d40439b80658b15fd52c5c1781e6
SSDEEP 384:vNKbU+Y6MnmfdNJ3JzcQ+bigVNCnx+agTGa/MZlAS9u2ILukE4V2gmoRIIw1sLgH:vp+Y6LJ0/F6/4S81G2KP3oEkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 98KB
SHA256 04cca2936627422d262541154d006e16b14dbc88bd7daee1a1a9bee1b459ed9b
MD5 5b72272d1aa355434eecae997d68771f
SHA1 53914fd618b0c8eac24b7da3d41a81166eb5acc4
SHA512 41a225d75176d7bfce1f589e4fe43dff6bc7b1f433a6e269cacb30da232fd38112a9c682bde06c67f3527660f72e7572d888d2eff2aaa78d33250cc6824e07af
SSDEEP 384:oNKbU+Y6MnmpNJ3JzcQ+bigVNqK+EGa/MZlAS9u2ILukE4V2gmoRIIw1sLgccbX/:op+Y6XJ0/d6/4S81G2KP3oEkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 103KB
SHA256 4967862cb464deeb402926fdd092834d29ce304f2894d925a5ac4abac334df7d
MD5 91f4406183b673aaf394a910803b3baa
SHA1 e7addb74736c5f80e33c3891d00067ce29568c30
SHA512 2086bade3fb15f3ea27bc02084dd4c7a6fbc411ab071a6e1454a218bf99b2ce5b3cb47ab7205f214cb2918d894e61844a110055f0e97c3db3886d2330910ea0c
SSDEEP 384:mNKbU+Y6MnmfdNJ3JzcQ+bigVNCnx+agTGa/MZlTBS9u2ILukE4V2V8rqmoRIIwz:mp+Y6LJ0/y96R894S81G2KP3oEkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe59c932.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59c932.TMP
Size 93KB
SHA256 8ad3517da8115cabe35e7784c2df4feb88870e07b1cbe38a78868b0c0e839aba
MD5 355b5792db1e116a67a6da382ae62820
SHA1 3841a1095c9c2fceb5d9065eb6ab8f989568afbd
SHA512 53896c675ccaaa24aa40fb8a5ff147365b5309a14fb0b8aabee749dc40fff10d85be3ab9836e5a1e2b1b8d9b42d941febd2e5fb16721362b7efe25a43ebacca0
SSDEEP 384:7NKbU+Y6MnmryJ3JzcQUigVNqK+nGaHMZlA89u2ILukE4V2gmoRIIw1sLgccbX2q:7p+Y6oJC/06/4I8WG2KP3oEkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download