Overview
overview
10Static
static
10EclipseRAT...da.dll
windows11-21h2-x64
1EclipseRAT...ey.dll
windows11-21h2-x64
1EclipseRAT...at.exe
windows11-21h2-x64
10EclipseRAT...ox.dll
windows11-21h2-x64
1EclipseRAT...re.dll
windows11-21h2-x64
1EclipseRAT...ms.dll
windows11-21h2-x64
1EclipseRAT...I2.dll
windows11-21h2-x64
1EclipseRAT...or.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...es.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...es.dll
windows11-21h2-x64
1EclipseRAT...op.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...ks.dll
windows11-21h2-x64
1EclipseRAT...ry.dll
windows11-21h2-x64
1EclipseRAT...io.dll
windows11-21h2-x64
1EclipseRAT...re.dll
windows11-21h2-x64
1EclipseRAT...di.dll
windows11-21h2-x64
1EclipseRAT...pi.dll
windows11-21h2-x64
1EclipseRAT...ms.dll
windows11-21h2-x64
1EclipseRAT...MM.dll
windows11-21h2-x64
1EclipseRAT/NAudio.dll
windows11-21h2-x64
1EclipseRAT...on.dll
windows11-21h2-x64
1EclipseRAT...or.dll
windows11-21h2-x64
1EclipseRAT...rs.dll
windows11-21h2-x64
1EclipseRAT...ry.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...es.dll
windows11-21h2-x64
1EclipseRAT...rs.dll
windows11-21h2-x64
1EclipseRAT...fe.dll
windows11-21h2-x64
1EclipseRAT...ol.dll
windows11-21h2-x64
1Analysis
- max time kernel
150s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
16/05/2024, 14:55
Behavioral task
behavioral1
Sample
EclipseRAT/Andromeda.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
EclipseRAT/Dynamitey.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
EclipseRAT/EclipseRat.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
EclipseRAT/FastColoredTextBox.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
EclipseRAT/GMap.NET.Core.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
EclipseRAT/GMap.NET.WindowsForms.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
EclipseRAT/Guna.UI2.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
EclipseRAT/IconExtractor.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
EclipseRAT/Microsoft.AspNetCore.Http.Features.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
EclipseRAT/Microsoft.Extensions.Primitives.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
EclipseRAT/Microsoft.Threading.Tasks.Extensions.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
EclipseRAT/Microsoft.Threading.Tasks.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
EclipseRAT/Microsoft.Win32.Registry.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
EclipseRAT/NAudio.Asio.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
EclipseRAT/NAudio.Core.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
EclipseRAT/NAudio.Midi.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
EclipseRAT/NAudio.Wasapi.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
EclipseRAT/NAudio.WinForms.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
EclipseRAT/NAudio.WinMM.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
EclipseRAT/NAudio.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
EclipseRAT/Newtonsoft.Json.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
EclipseRAT/SimpleObfuscator.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
EclipseRAT/System.Buffers.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
EclipseRAT/System.Memory.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
EclipseRAT/System.Net.Http.Extensions.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
EclipseRAT/System.Net.Http.Primitives.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
EclipseRAT/System.Numerics.Vectors.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
EclipseRAT/System.Runtime.CompilerServices.Unsafe.dll
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
EclipseRAT/System.Security.AccessControl.dll
Resource
win11-20240426-en
windows11-21h2-x64
General
- Target EclipseRAT/Guna.UI2.dll
- Size 1.9MB
- Sample240516-saw36aaa92
- SHA256 952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
- MD5 1915011997fdb9aa95f15e567f4e6070
- SHA1 40a7853f14d6d4919279965f026d57cf9a104998
- SHA512 5cca71b42ed9dc154e6d5919e7cd93046168781a55c051818157848efc918b2e4dd92f422eb1c47e0940b645ba750facf83bce240748a8170ac8ce0afc9efa90
- SSDEEP 24576:XJXD/hBn13g+Yi9oE7IYbO9ZY/NJdAjED+aE0qUaiIwpHQ/jz2Y:JTIYbGQdAjED+aE0LaiI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133603450893716393" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1960 4868 chrome.exe 91 PID 4868 wrote to memory of 1960 4868 chrome.exe 91 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 1232 4868 chrome.exe 92 PID 4868 wrote to memory of 484 4868 chrome.exe 93 PID 4868 wrote to memory of 484 4868 chrome.exe 93 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94 PID 4868 wrote to memory of 564 4868 chrome.exe 94
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\EclipseRAT\Guna.UI2.dll,#11⤵PID:1752
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8760fab58,0x7ff8760fab68,0x7ff8760fab782⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:22⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:12⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3520 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:12⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1768,i,18139123875826481971,7730496369349527230,131072 /prefetch:82⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 688dc688b6ed1065bb42f9ee508d7034ce3e5456fcc4d30f20a2713ae13d521c
- MD5 c1490a116568debe829c2bbb5c6acd6b
- SHA1 635fb2cac259a28ea53f5708cee748926a5a5dec
- SHA512 493a80e934c1986b76406fd369b991a38194c475476dd5ccd31bf5493f4c892bbe80b89036f2400c5acfda6697b898be5680fe32ced7622c858ccab96581083d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 42a119b6b52a16bddec0a2e395326e48a8354ca8914e1b170b974c338c3cc390
- MD5 7f07f3cc9c9c1ed66497e71c035b455e
- SHA1 aaf6adc06732aae018d1d29f39d295f33c05dd91
- SHA512 c60e2b23492ab7526e8c27ded5bcb9918334fac0b75e669b8c0d68db28c36fbbc6f29b373e803efd828ac5b64dca4181a3f030627f80630c8932061303f08e69
- SSDEEP 96:HDzXhk96XHJ1KIkJFPnE8iZRy7Dx+6MSmueCIOHZkXnHv2MEVhYtjEsXt0/cgVup:HXXhi6LaJxE8syh+FS7SPP5tjEsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 d30c3552de8754f2a5cf635ddbce257b0c6a09f8409c0ef62487b4649e828ae3
- MD5 f789827f6491c30de5e953e4dc2c4026
- SHA1 db73573f7526ca07c150a4d9f946c6f6cd7173fe
- SHA512 53205f44a197d4d88f547e4aaf2d9d507beeb1e8267b56db2064e5b58fbcdf64166deb464498a4277b1a1a70aa8277efe062bbb91ef977087514d7ee0f546e31
- SSDEEP 384:XjxdLPLeYCXGe1kXqKf/pUZNCgVLH2Hf9PirUUoHGTZ7K4Z2zr:XtdLPLlQGe1kXqKf/pUZNCgVLH2HfBiE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 258KB
- SHA256 1e0b59df3fd40e526fe4d7c6e78af033028f5acddad6925f1b6cb88215c4a814
- MD5 b15475a5445d6148c8d7eeaad087c3a6
- SHA1 522f2fdc38b2144776c8a0d5c60fbf315de00f10
- SHA512 5b29a9a2c7daaa9ecf07a12b9c325d3eecae06c7b5e3f19a6574a1c1c55ffeddc639d0479b66824ccc41730846566f4096c36c956a4ff92f1b48f8450db27c3b
- SSDEEP 6144:N3JGVrfa9QhUJ0cPoAurI1Qo5yzkpeXjnJFzXsWz:N3+TmQhc3uEjCkpeXtFbf
- MD5 SHA1 SHA512 SSDEEP