hxxps://cdn[.]atomicfn[.]dev/assets/files/v1[.]exe

Resubmissions

20/05/2024, 18:03

240520-wm9fssbd491

20/05/2024, 17:57

240520-wjyj5abc391

Analysis

max time kernel
91s
max time network
261s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.atomicfn.dev/assets/files/v1.exe
Sample240520-wm9fssbd49

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2992	2848	chrome.exe	28
PID 2848 wrote to memory of 2992	2848	chrome.exe	28
PID 2848 wrote to memory of 2992	2848	chrome.exe	28
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2864	2848	chrome.exe	30
PID 2848 wrote to memory of 2812	2848	chrome.exe	31
PID 2848 wrote to memory of 2812	2848	chrome.exe	31
PID 2848 wrote to memory of 2812	2848	chrome.exe	31
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32
PID 2848 wrote to memory of 2860	2848	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.atomicfn.dev/assets/files/v1.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7219758,0x7fef7219768,0x7fef7219778
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2252 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1400 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1468 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3404 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3548 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3568 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:8
  2⤵
  PID:284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3852 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3804 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1092 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4084 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1628 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=872 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3664 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3388 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=1452 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3400 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3448 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3748 --field-trial-handle=1376,i,785590343982390454,11538665036855387351,131072 /prefetch:1
  2⤵
  PID:2220

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 03b5d937103254e5a6d00b140be4ef2640d9c9ff16952eeedbee85dd9787a83d
MD5 9c05915be9acbef8b40815037994b19e
SHA1 875240b59104988932bc1fb9e57f16deeea19279
SHA512 02dfabaaf2e276840a8aecca686924210b9ee01f87df56eb5df33588c920c126ee17202a1742fe47050ac936ccf913eb2a9f736adab0625c58d169ca126f00fb
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 692a6dda1b40bfdbc6c823cb4945341fee2023d06ed2e7ab13d96855093b3108
MD5 fdaeabf6f30f8d80f80885b435f6b415
SHA1 8feb3579181ab936dd866f2dad85831287d26529
SHA512 18455da4902f52954f133cdea6ddf7aae143755092c87fbac32c30877be7f18247beffc1c4a29ef7dcd446d463a380d9b9618039aac51a1b944f8eeee9c58680
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 9bef5a0cc6c0625dd98290ad6c8fb97ea657681a9a94b5f0ac532ba6cebe2516
MD5 eb3acbcae7275a57d346e61e5dd2f3df
SHA1 00be817befee74eaa6b546d984dfac025837744f
SHA512 558bc56d612cf86ac28894a52d08ca3a3c30b5ea668d2fffc5dc58339f9e1f3286706db88e3dff10a0f22b48727f099b72576a0f029d015f2e2710fee7e7af4f
MD5 SHA1 SHA512

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 41KB
SHA256 41f3ff915170b329d58256f1d9d9aa02876bf3f8ee9a78e39fda52b10618def9
MD5 46b744825358b40bf95568e0f5046770
SHA1 50ca81e971f688f2fe77482a54a3d4892bec7eb5
SHA512 2b4f7ebb56091445510e396a9564d97bd18c316d948a63f331447510127c16dbe2fc105f09d56712c86fed6743f381317441dda02c28a3d75eff8ba91af34da7
SSDEEP 768:TvWtTbsGosQsqPxgr1wPbGk0FgiqEj18GXQosXu0hxbOdpa1v0HKVi:TYn2sLq2r1wqk0deJoYCdGOyi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 60KB
SHA256 04a6a3f8ee79c1e59c785c5b7845b626ba7e0aee8ef555b24e649a01343b2497
MD5 f0bbbc10207e917ab304a07c73ecf07e
SHA1 13e9e88a447def6a65e6e7c4a3ac4fb88b3e09c2
SHA512 7b207130c545c88f033b6d944f009291ec020c1a0706d3030281e584751e4720af593df7e48144a8c3dff43f0c7ed9d87f8d8dd278f79ea53242647b1a84c444
SSDEEP 1536:LqYNTIjF3tpYqRCVN5KSIKer0bNQ36UDtGsm3k:G8sjF3tpDRMKbKer0NQKUmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 107KB
SHA256 516ac539eacfea826b2f34bf7aff3f05934d554648e057dd3854f2fa6c1bd91b
MD5 952ff98094cd87011cc1b1bb34191ed1
SHA1 74bafb5f6095ed60647f4d9b4257189b3d0dbb6e
SHA512 03fdfaee4cd578d13ad670eec474b5ba8d73a6a069cb1f58099521902f34f28a09fb2f298f4abf39deac68e3dc8ae91ba269c1aac2d3f94b227ae1c4039977ea
SSDEEP 3072:955CAnHe0FA94NGq2o1h9EBqJl0eBkHtlEcbZPUFC:j5CAnOuGq2o1hOBqkpGFC
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 120KB
SHA256 1324abbaabc220818beca5afd18e15d5546a89e14f965922414a8433133b2379
MD5 1dc48c73453aa0b91773215efa472641
SHA1 f405a44fbaf749b5cc7e294c2500fd33032513c9
SHA512 cfb3add24b20f8f317cc58214034892e3c96328030902d9ddc09c6e0906dda7042e1f54fa0728bda6bee40f7a3bced8e2fa30d0222f2a2d32ebbee677c0b34cd
SSDEEP 1536:O23SMwQqxm23SM5R9s/pt48WTvZdmvz4SLNOM3o2v4FMlwI0w8EL:T3AQg3Mt48WvmvzTO6vnwx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 119KB
SHA256 ce3c6882930e97549c7177712f08793a5c0198c3ec948c7ca948c66d06e92d85
MD5 c27eecbf32ce28c634ba8a4b6a61e6b3
SHA1 b472e61fe0d17dac3ea12d9dbd6801f59f1c1ebf
SHA512 c11cf05ec920b0246b9b813d7b4d40cea3bf0dc53971d72ed7466b92e357428a3182b15b5b0b65acb5bfa9f9686f178f7ac354775d39adb512782652a942c088
SSDEEP 3072:4wFrtm9Sq/LiHuSUncvXMXTQKupnoI8Ugch+6leFueL0gD:4wFrstDzcvcDQNX8oh+6lQu0D
MD5 SHA1 SHA512 SSDEEP

Submit Download

8894ca068436fc49_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8894ca068436fc49_0
Size 3KB
SHA256 6108067ec3e017b110ab9619567abc634be9637f72f3fca6c60b49e0367bc73b
MD5 933ad470121ff828fb640380a04e6b42
SHA1 1e4861d20c84279f42882f58a6771a2b520b4289
SHA512 08a46662cd8fac1a9bb455f97ca2b680f64f53b69ea82d10c15bf0f500b5bd0277ae6654378c045c75f0309bd62615343b91d8d493df50bec0b64cec1b7b2f3b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3354d21b1b9ec398849696204ad33734695d1962e852dd58a39a54ec1a93ce4b
MD5 45483b154e9590c803b088fc946a1f6d
SHA1 3e73e3b6d24d2fc3f4ba96e383aa1bb9ba2f7f1f
SHA512 1dbd7dc12b7ea818423f77827e193e99c9208e52cd66d3ae85e359e7a602030ded5e681ad45690ad90a88e372ea584658d11184dc6871303f11334e8e7a957f1
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 06608cdb56297a9665bf852824b03a17ff7a8cdff8474b6fa4f0f4382790a57a
MD5 c67f3c12ade5330354f9d373bfa23246
SHA1 a037d33b2136d1a886aae165f029aea460fef95d
SHA512 08f6086ba343740ebb665838fb7a5a440b29e3c6e244ff168df9cd3a536f9d6e134b178b3edbab62b2d00d16979c0e3713f5e43b82910bd3e988ae7cf511f7d8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 912fc70b60095b43a83189cb4cf8a87edf2a1c6b54ed0149a1ce665405e097ad
MD5 24529bbbb4d2acf6eb27547319ed49ee
SHA1 c5f7834fba06b860782e5b98fc45d28f12107043
SHA512 4b5196d0aa857302495eee878acc661f83501e0eb2835ebb2ebe9ecaaccb8c189bd36b7a086be43489d12b29190a2b4ea156635df35016e7c96ca16c3249e968
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 832fe4ffd2e082cce9e6f4c2c26b36ed75ba397f2390c26f2a0110a70ac9945a
MD5 19c4f84096a3bcba865e51bafdd16f0f
SHA1 812a4787f368f185e8223f22556bde8e84d3aa24
SHA512 55a34fb9e93974f617b392721cb6c16a381664aa02c6a592c3177507ff4af98f308697280fb488c3834bbd67844c38cae68ba9100d60221448617204dc2f3084
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 1b7a5f0213f0076dab2e551f68650f8f14726856a8aa0484b9b97355d1f0f2d9
MD5 d6239b67ce6152f942bb7be6b0a1a448
SHA1 cfe036b20cee338aa99fee41e5456d009693c372
SHA512 c97f1a18df0fa6c7b79a323ebf6e8e834617362c68c58705d3bdc5a32051f4d697b24869626f0071a8852166052b1d2d484f46fa21dff16ec2454b72ca8f7350
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 5ec74919250524504dd45f851189c873294c5a4e501ef2f8ab47d811978fe0bc
MD5 67319058d0030196b202fdc70290c519
SHA1 08be0ebf857b2a7a6b3a66e4dbd7519cfb18ada1
SHA512 9a9d954a27d66aded675aa44aa8559c20cf79729a10102ab4cbfa5f3ea576830ae61179216b3cd1db891ad1028dd828fbd36510a122d61a5339f40b7515858d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 fb758f251e630fa03ef32ce7d998942848996bd00be5c96e7e4f804af157d17f
MD5 41952280dff98315de8ccf1e15dc1238
SHA1 8f16b83ec07edb1c8b3ff0dff414db7128e7d41f
SHA512 80894239298e623777f5a447b33e95db10dc580a491d658d165b50de93b1c3e0f417b72e4b8c893118adc54ac016630529c5bf7e4c322542a55f967f4c4a25bb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 32a7388886a6c999407e642de96b14f0881e046c7081745f4fcb055460467b8b
MD5 24237742cae22d353b88a7e8690727ae
SHA1 6ca05c07ce7ade44e98ecc492911804de5f6826a
SHA512 4854d2e24eb889a909405e59a55fd363ba5133112fdfc5b5b8ff34716aa7bfa4492c11491f03d1416ffec9e6b509ae84e7b439d6a9336f7cdc99fc410c8c6e18
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 392f343addb6aa113bfb58f3f343f30af331c4011104c1a90eda327136928de0
MD5 bc2d040cd9a0afc850c5dfcf2c998078
SHA1 a7ab2cfb1ae0ae7341c1d0c782d7a912490c250d
SHA512 ef41a497d46d47f6e7cd1835619b4c599b1e8726cc8b961a47e9448b66d75debed30cfef88dedc65d49aa3a462174b720cab675583e3f749b5f46ac961063767
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 363B
SHA256 a2d673d6a36f31a622f9ef1a3482f055d37308ec4ad94b08d597738b4dedebf7
MD5 6ab24befdc1bf518de3c64023ea5fd0c
SHA1 a6cf5d5b4eea17e079fd63ff5e0a3a106501be06
SHA512 0eb556d4d2b1727e2875931221574ac2e08e9bf3a4727da4c07b239ea48b206b9c79b0bae979c52e431ec77ed84d6f0753e2f5907bfabdc4075b064972cb8e34
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 527B
SHA256 cfff22af033df8d3fae20af2fdd55bb2900034070033a6f51a417cb9ec28c791
MD5 2b7099ffa1c4d6ec9aec069dfff7ef4c
SHA1 85f1b75ba88e8d5c05538a59fed23a33798891a2
SHA512 8d227615d8d7844a8319dd3a8763fa3359114af9cb06ded20e87ca4014710078b9cca28b65f99753ffe7a2d77155086f28fca4c25daa0c713caa11d1117f4238
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 e255ad3187d050132079fb031395becaf5599fc04030ac03ec7971a3e9660caf
MD5 62dbcad8076eb176606449a3334c469b
SHA1 abf5220ba0057c6ebaa9f452cbbf03e7e7206323
SHA512 f72eafbbdf78fcc4f6306e05fb75ee06a3bfb874b9667754e7604d09f7bde9808e883c5e153c8112b9cba8fc1ee7d81f8e4a5a72e895dc10c395194d24494efc
SSDEEP 192:NGc2kJzU/W8w+yy+FHekEjkiwotjEsXtScPS:NGczSyxHEZztIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 be39406b9567c43bc0836d1eb1c874533b4da12ad3812857a4146ffac2872788
MD5 67b03c511cb5a68d29d230df815e0db8
SHA1 d6d2b70907fa0edf34ce7944c1954db811c6eed5
SHA512 4872a0a7dd935a4c74d91845c4856b41fb826d091853a1a48f2a2628a5ac0fa5f9a341674010be9ac3ac741efde1fe213ef145eb073fb4134adcdbb050ed2a24
SSDEEP 96:NuPUKICYsE4d8iZRy7Di+6Msmde2ekE17OvRQijVhYtjEsXt0/cg2Vup:NyU/W8syy+FHekECotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 42c1baef786efaaa5fab9022763a6356ad093f0deefaafe39c2d2b18c593db88
MD5 4252ca1689b0b5004b6b1fe17f04ce98
SHA1 a12261f15e08e09ab1ec6020edb093e4bb49c635
SHA512 7405376bdadff4c3b4b792c740252363603fdf41f3535651ba935e26ecdd44097569fa96c7d1e4392cddbf7765b02d164862314d7b5891f8365292de00196641
SSDEEP 192:NGc2kJCU/W8p+yy+FkRekE6kZbotjEsXtScPS:NGcC/yx0EtMtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

a5901fd3-e3c4-4146-9015-1c59a61b04e8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a5901fd3-e3c4-4146-9015-1c59a61b04e8.tmp
Size 6KB
SHA256 1dd29c180d67541b83f173c82b239ffab1f3d2362140f7004659badff863fdaa
MD5 501f7b20336979e9708a4670d2af11fe
SHA1 a10e3f2e5feedb3b219b3acc1ea2b7b6b496b2fe
SHA512 a8c5985cb01cc10151e9407f3ec962bdd1ece56090f96dcb1dcd36526ec105d787b9b0496c2f249b3ead75b374eac3fea69e9bf2f465b2d7cc799fa88a36be91
SSDEEP 192:NGc2kJCU/W8p+yy+FkRekE0kP6kZpotjEsXtScPS:NGcC/yx0ExtKtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab72E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab72E1.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar72F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar72F4.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download