d3547a50c87f65708dd5cc01a55f2449962f552ba0e0dab6f54bb0e116028b69

Resubmissions

26/04/2024, 07:52

240426-jqc6jscb3x 1

26/04/2024, 07:48

240426-jm6npaca94 3

Analysis

max time kernel
96s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[0.3.2] ChatSentinel Premium.zip
Size

4KB
MD5

83c788f705a76d236f4770fa6b5e4f8d
SHA1

d4465b15418d760198a547a9db5168f62fbdb5fc
SHA256

d3547a50c87f65708dd5cc01a55f2449962f552ba0e0dab6f54bb0e116028b69
SHA512

9e685d57766bcc0e169d279aa89283df66fc84b02fed18f5383934d297c92cf3b8e897778e96bf31c0c7efef5c378ae325ad7e4e1ce39379f3ae1a08dbf4b1b7
SSDEEP

96:73pheZjJ/5QgSsOQvY99hhf9HlDPrlPTsT0l2w8ab5jbUbY:77eZusZY99hhf97yIr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	chrome.exe
2996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe
Token: SeShutdownPrivilege	2996	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2924	2996	chrome.exe	29
PID 2996 wrote to memory of 2924	2996	chrome.exe	29
PID 2996 wrote to memory of 2924	2996	chrome.exe	29
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2996 wrote to memory of 2568	2996	chrome.exe	32
PID 2528 wrote to memory of 2448	2528	chrome.exe	33
PID 2528 wrote to memory of 2448	2528	chrome.exe	33
PID 2528 wrote to memory of 2448	2528	chrome.exe	33
PID 2996 wrote to memory of 2456	2996	chrome.exe	34
PID 2996 wrote to memory of 2456	2996	chrome.exe	34
PID 2996 wrote to memory of 2456	2996	chrome.exe	34
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35
PID 2996 wrote to memory of 2792	2996	chrome.exe	35

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\[0.3.2] ChatSentinel Premium.zip"
1⤵
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c19758,0x7fef7c19768,0x7fef7c19778
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1452 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:2
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1244 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3288 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3692 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3808 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3772 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3952 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2768 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=1352,i,5674473654117688952,10654804942302303078,131072 /prefetch:8
  2⤵
  PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c19758,0x7fef7c19768,0x7fef7c19778
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=964,i,18356213985874239325,5957471120064092423,131072 /prefetch:2
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 --field-trial-handle=964,i,18356213985874239325,5957471120064092423,131072 /prefetch:8
  2⤵
  PID:2044

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9a2c2cc1987d1e50b9d71a9c555d70

SHA1
614738e5e1fc97d7a36977d8f31b552c78302cb5

SHA256
da5ca69bf4fc50b08f9d84d2ccc22ee9232668ea8a2b2eb70f669a97e1d9575e

SHA512
5c1194a85c5a78397c92e0724362c89309e33e1acba37731a2816296bcdf008a6db77eedea876c2c51b1e702b746f7cc332dbe79d9eb67bb425cc4370177d186

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\94031cc0-c88d-4f5d-889a-ce1ceb30a1f9.tmp

Filesize
130KB

MD5
7d99a4dfb1aeb8e1019f53dfdfd7af88

SHA1
8c81f2098d3ee3ede3904efd557c193b5d939b07

SHA256
2390789e64da6672ec99b979afd1749ffd1575940f197604cd4cceabf67d0e84

SHA512
fd72ec1799458f9179aed0fba65b5bfca6e3031f01120d0f2b3aab8c2c4d96feeea7617dbc9760ff5f3958ca8a34e2859679504650742944483512a9af39eed4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
89f4922a7587a9f92f626d7868051285

SHA1
9419dc4f12c1cafefe5a1a12997cd4c0ae5d6702

SHA256
16d4c209625f423200c0a930685ec659bdc58c7e5c7848d0008979311b945ce7

SHA512
009d7b6d168824bb8c8c15f256502673af694fec8b7fd3761567bddcb0c40500d77de42c13313fa33e7848d8380d097cdc4c14dd21e71023572de5508127f9cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\430fef84-ab6c-4d56-96b6-66c0a385b5cf.tmp

Filesize
986B

MD5
0e7381ab0065f664208acacbc1ff39e0

SHA1
891bbfef653c6f19b9481a7366b1c86862cb8129

SHA256
43986ccb33d96a9331f0a693be1aa6b9873743daeb3a0dc3ad71771aa1ff6677

SHA512
17ace5f08ee8f91d2cfa1ea1fed9a00f5832cde3cfc39a5aac1d9bf81e8be0217c907e91c790c1b0cda365537705ebea7357ad3c8e9bec2904ade0405e816de2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
eec30fbbddabeaa56e22b14bd9353649

SHA1
3c9214edb996cac34896820b1f4fc2e88635fd45

SHA256
d105182423e9a9238f3efb58dfab4fd530bbdf905009ef6b8fb9aeb3fa5cf2b1

SHA512
0a4d0f3970b9925198e9a47fee9f09bbbd538ccbf3b9799c6410d43051c9337f1445eb0a2d31038a764a49c7fd6ff6f083b84fc459958ba9025da16b47f7a927

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
986B

MD5
f5d2e0f71f9538c7c6b44d414d000b15

SHA1
43d6bd84d37a7c2866208ee195e2c00f1a1adf8e

SHA256
64300c33fa3034065e1227d8d60d8d17ac567b933a2d35e1299370c7612e318b

SHA512
75dfad739f499f90e3409de8dd4d01aee8eafece01dca9ad4c30b7687c594caecc7637b8bb6752dfae284fbf1de92e99c81154c224f8250409dc024860b9ff8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
889c2e5fd0912c88ddabe691b94f937c

SHA1
73d3db051b0f956b6b84ce86334ce7633d0b9bad

SHA256
6d0d6408c6d6568ebd2df1370a3647ad23a8f88064cdf72c705e93313acf4b94

SHA512
9c56a114a4ef9f90defed8e772ed9071a0dc167b95cef8da4bb8432355762c6d4590b61f7dd2751bd1245d1d7eebad2fdf0ef27a38bf320650445579065bf5f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b1b968fd21ae1ee5820b1fb78f27c4f6

SHA1
8fdb419d1395fedce0619907910581d57bd99bc9

SHA256
84affabda3d614abf5a8388592c450f5d409441a1fa696fe29418695ccb3a495

SHA512
7f4dd3fb0239b7b2594ddf0f92d0ce9b042053119a35d3c7713d71c9744cc3e201386e293683b9af2d73e06f1fffbe174d4a8366f9732882fadf5ce7028b8ef7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
12120edd12bfc553848ab0b8ccd8faed

SHA1
bd2ec1537a0d0282fa79f01238a511673d1868ee

SHA256
ef6156fe3daea71d405a30848b5bc981c392f2e098900c39d8bf4726907906ff

SHA512
1c12a74238a63a0aa82322986e5c06472b1fe96e2c0156fec07b0a41987b4ff7141350399ee94459e6bc2566b210664df6a25875b90cb058c9da67bad0ec9bab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
7082eb4af457d44f85384b505bc21351

SHA1
2a9271adfba5be3ef7abe590a0a096b7a28c41f3

SHA256
48e229fab93e22cae0f60203f17e82e11c576e6b1da60ec55919c4382a114ff9

SHA512
e2f9685c7cf45e9e7dddb022bd5702cca78dc44a51c7b89cda2ce3b90f3666fe611186aeef68934cd38840d8a3ed37a192eed97fdc43094d2564fedd91b1e808

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT~RFf76db42.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
266KB

MD5
37ef3bc7c583191a95660ca4d96b6a53

SHA1
31a85d6f6d31d59ba3c5070cfec23a229b59387c

SHA256
ca9470f0cb484a3b3e68c2270980851e679f87c16183948bb2b7803de7dcb38a

SHA512
225f254ac3c90cb5e5ecec847081c3c52dfd41490118bef703104004206b61c235b7c0fb84205c9f0d1f21c666107a135bc075de0843630534a765f7288be62f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
74KB

MD5
ff49390629b66ce2e2527fb860162c47

SHA1
6c9e6cd257191e3e69def0347e4175cb4fe557e0

SHA256
67e27719ef5037e893301650dca81cf06732a54fe00f2fe15640f058fb1b3a28

SHA512
4f3835fd650adaa49f4dba805cc2b8aec4a850c4894d2311b06f2aa7aa8f21f39d550c2dd1cabf82a2cb67b6d31911b349a3a6bb82727b0ccd61a5cc2304fc58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB463.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit