Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\AV.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\AV2.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\EN.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SB.EXE	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\tsa.crt	C:\Users\Admin\AppData\Local\Temp\AV.EXE	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\SystemTemp	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Enumerates physical storage devices

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608454354796214"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	C:\Windows\system32\cmd.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D	C:\Users\Admin\AppData\Local\Temp\AV.EXE	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D\Blob = 03000000010000001400000030530a0c86edb1cd5a2a5fe37ef3bf28e69be16d2000000001000000b3020000308202af308202180209009168978ee53f5964300d06092a864886f70d010105050030819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d301e170d3131303931383131313834395a170d3132303931373131313834395a30819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cac8419346518527133fdefd7982ac3919f1d6e2f815ecab0b5d219ccf843885645cfd9c35cae2eff8e7506e690b52c587a59c8d667cb671454030bd370fa334b18afb5ea4f4f819a36685a705a8543f320af913ca680a1d32a402db6d3e42d93228e44ba230fda524d490ddc35b922f23d36d95417136ac50afa567e21359350203010001300d06092a864886f70d0101050500038181003c6a7f43ca2cee1caafee88b04777032a4c9d7794222537e3ebe57953198281bdbe0d3a58f7d3eb358f361848f30ad88a364cd0ae3376e6239dedb01497d52d3dd55e78e49375373419ad7e5e2e036f713bf4d96a552f2aa26b35b66d7a83fb2a9b6e317d162d8342f09ccc71b2a1c7d9474ca7872bfa4acd623d61c4491d740	C:\Users\Admin\AppData\Local\Temp\AV.EXE	N/A

NTFS ADS

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Downloads\Ana.zip:Zone.Identifier	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\DB.EXE	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\dugga_848274.gz

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe6b3acc40,0x7ffe6b3acc4c,0x7ffe6b3acc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1792 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2116,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2108 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2168 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4464,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4508 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4500,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4068 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4084,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4672 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4808,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4444 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4760 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4904,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4788 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4812,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5084 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3328,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4380 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4336,i,14938497397547022100,715208045904645321,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3472 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_Ana.zip\[email protected]

"C:\Users\Admin\AppData\Local\Temp\Temp1_Ana.zip\[email protected]"

C:\Users\Admin\AppData\Local\Temp\AV.EXE

"C:\Users\Admin\AppData\Local\Temp\AV.EXE"

C:\Users\Admin\AppData\Local\Temp\AV2.EXE

"C:\Users\Admin\AppData\Local\Temp\AV2.EXE"

C:\Users\Admin\AppData\Local\Temp\DB.EXE

"C:\Users\Admin\AppData\Local\Temp\DB.EXE"

C:\Users\Admin\AppData\Local\Temp\EN.EXE

"C:\Users\Admin\AppData\Local\Temp\EN.EXE"

C:\Users\Admin\AppData\Local\Temp\SB.EXE

"C:\Users\Admin\AppData\Local\Temp\SB.EXE"

C:\Windows\SysWOW64\cmd.exe

/c C:\Users\Admin\AppData\Local\Temp\~unins531.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	43.229.111.52.in-addr.arpa	udp
GB	142.250.187.196:443	www.google.com	tcp
US	8.8.8.8:53	234.16.217.172.in-addr.arpa	udp
GB	142.250.200.14:443	apis.google.com	tcp
GB	172.217.169.46:443	play.google.com	tcp
GB	142.250.187.238:443	consent.google.com	tcp
N/A	224.0.0.251:5353		udp
GB	142.250.187.196:443	www.google.com	udp
GB	142.250.178.10:443	content-autofill.googleapis.com	tcp
GB	172.217.169.46:443	play.google.com	tcp
GB	20.26.156.215:443	github.com	tcp
GB	20.26.156.215:443	github.com	tcp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
GB	142.250.178.10:443	content-autofill.googleapis.com	tcp
GB	142.250.178.10:443	content-autofill.googleapis.com	udp
GB	20.26.156.210:443	api.github.com	tcp
GB	172.217.169.46:443	play.google.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	140.82.112.22:443	collector.github.com	tcp
US	140.82.112.22:443	collector.github.com	tcp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	66.96.162.135:80	middlechrist.com	tcp

Files

\??\pipe\crashpad_408_LTTMZXIPDUQPOYTD

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5	7ddbc7eeb2d3e01f3ed74233d5b3761e
SHA1	3992310eccf1f1891f4048ba04b839361e335d0c
SHA256	a33392f2164b62397aad76506cacff4fc6b06478f1a24e32d0f40b0cdc7a90cc
SHA512	4cf2b2d9f1338f4bfbbd06898d2f15d9cc9e618f8b6168700f88946de8c9fd9de3c16436ad90fe8b3ee05af182b47a95331e72a506d66da4d4c5f5709f294e02

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5	f998b8f6765b4c57936ada0bb2eb4a5a
SHA1	13fb29dc0968838653b8414a125c124023c001df
SHA256	374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef
SHA512	d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	b524c90149b9c5de693df7b3326791a6
SHA1	23bd28c5d7dd52caaa97127886da0150efdfca04
SHA256	f41f1c9099364ceb0064059cc2f7fecb77ae8d6cfb29191a43c73402287d09e4
SHA512	29be8ba53c8daff3db06392115b1ace7d48e7fe3785cd4eb6d90433e58ccdbfc16eeb3a56501d2298adde106127b288746ed1c0ff5dc129fe70c898d52dd432e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	47b4f82a4c71d364ae63d1f745c42aca
SHA1	9aee3600569441a50db0ed5f0ca8efd430a574ea
SHA256	078588eeacae8ec69930f0ef5bb4768750d3aed54a4d1db5ce25963fc835a29f
SHA512	811bf525eae2cea7afe9d6b09b1b550f481a7645b96c131902757467bc304312f0630b4419d3739da7424b30a0c4ec65b8262c93f50785a3d500fcf77851bd02

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	0d535f2911795b05789d01d700827c64
SHA1	cb9a0686ccc4a29a984f9d413cbffcfaa6a1a33c
SHA256	0f8d94b09e80b1c90f9dea5a18207ee1ca86de9160f2464eee95729c5705008e
SHA512	dec6b33eb17b395a0c736b74e96c1b98b011fcbb67ea1839b4777dae05fabbf13811456dc254d79c12aeae8d2151624cb13a3d2767c23f2bab759ff21e6658ef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5	2cae537483d734587a558b47b9141d9e
SHA1	b8c8f7fd6a85152e0017166a3a89030eedd29e1d
SHA256	4bfdb4eadcb4e081e14a543b9c47eeadb5cc2d472c73daffd9afe17e0bbc3197
SHA512	c8ae29c5bc4c47c063c7a62ace41e4d15640c6393d353078e3c174190667cf3131f08e4e2a58dba05aa318a1d330c10ad88a8d5b84c3f2a250e0b46d30b416ca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	bcdc743b6c40d7e4bfe73e24dd567c36
SHA1	8d448e5cecc733e886cc6f2bc49c1dc175303e2f
SHA256	a12a7d055f754453d6bd3f730b4b73378b40b76c23ff69a8867d659c8fc8867b
SHA512	4a38762611b67dd5d3c271f6cb16d9bfbd4e04887c22ae7cece7a52b55ccd8b0a091c9b4a44c884b7a3b100667cdc1e38ff7995312532e825c6025e8e13b4ade

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	fa467798eb0ac22bd7ce611941627a13
SHA1	4de134d953c993092e52f0846077bfa3e73112f6
SHA256	676433464929153342e501f97bb490f198908a5d3ee738a40b94f9b494266eb6
SHA512	229192b30c1565e92b33e1b488f548faaf3734cd735459448b967ee41bcd51e8d5c5a1ee3b4f1c4c15d6e90118d355c55741391c5cb4bf0d42722c7f82756c26

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	680cc6a581fde4849ed1eae27ac15a3f
SHA1	35e534ed60a33dd66d0679d9ca737151360cf93f
SHA256	4a8edddc8d5993af96adbd79dee405d376b5f50fd5513246f7a121c8b06ea06b
SHA512	7ef992662c9d1d3687838919edd05cdf013e0a45afc9a061dc4256e125704a0f7b67f7b21b130ea5b3ed00080e6541f2e18f8fa2b32df48b1761f9fd4026ddff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	85cf631bba7df46950ec25d329646252
SHA1	a093999f713d1c51af2dd0590340e71fb4d7abb6
SHA256	87a19d5649df0033fda119042a2afd4fb43d0795b725e0f09ded6a08b62a5206
SHA512	1a260b9aae08f4056541a2e39b0f31e9177c13820ba219c58589d9245c9cfb6b209c917f1e4025ee7b65bf0c779852656606bcb44bdae12f87ef8f1d055d8029

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	4aa2855e90175f011365c82a5db206b9
SHA1	3123a8ce11364feb5e9886ebb134f20d18b1cbd0
SHA256	c970948133c298674d3f0b5d3b5d1de6dd4fcbf78745dced7dd8668293fede58
SHA512	717fdb3a1a1d52fc31f8f071c0c2ee6b8daa6f40e119368edf07d917285e0da0041fada44e02fabc95c2a67c8aa6619d74e02edb1377d2f704ab66ca63a9f4ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	039e41cc71c3c9cbde86156bc6840f00
SHA1	01afab9fdc65a2095d80b89c83f7ecd35a882037
SHA256	c8d87ea1d2bc925c3b123acae8147fe17ac4c2a92cb50c43e092b44475aea215
SHA512	918bf1b8a53fcbfe195a19285b4d5d4521a4b9314e05a273887ccd77dcf5bbe959043df54a60894906e25dd91884196ad03099bd334e5fdf13522ae3087abaef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	117ddc876efbe6733c45a5192b743e03
SHA1	250f7b0ea24cd8f22aca5365382071742d0424dc
SHA256	0b3e616fc57d70fe2caef69dbccf9d445b97d5af8bf46ec3b17e5560e001c2c1
SHA512	afe261973177133e3d5eb9d6a1c131e5b084cfe40817f538b65f7c1504c484d9c991a010ef92d0f08c940e274426fdd0c7d184dda786071d3124d79d475b9af6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	ee97743385d57a1c1cb6d699888eb62a
SHA1	5587f66e3190334fe582602f431451d8b4ba2a11
SHA256	faf7305b2039bbc384271fd8f3bbe30ffef754e4d33c936fc860ed1851e2aa19
SHA512	933db96a187e12b54a0b22e5ceb645363c973f5bd4e2ddeff838f2d6f433212bc7f0992debbb183fd4107579d8df475adfb7da0fecbd83dbe0b55b7979ccc647

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	73b0d06cbee9d159668e05e2d4c55153
SHA1	118c0ce4e64d00ca4f10c59fc323885dc87221e4
SHA256	48c77d8cfbd52df0bd317d1d6a7ac57b02ef3019dc66e6d327bdabf67e95ee2d
SHA512	ae4bdd3948464a415965fb19f8bd6ebdccbf3afffff4235b115b8765d4d69dccac99e8af3a91de7679726a369c574d1dd719878c6790ca2f3e5ef6054192c243

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	3dcd148048d5680178766c0b0aab4496
SHA1	8a7cbc20075fc1a8ef4ab1ae5540a9f328848cce
SHA256	d519ba6fb51399f951ebb7eb502cdae94e13bf8ac6f4ad0f72f5b6d3b43a760a
SHA512	865ab9ce9844642d98b1a3736ef5218194e32da379e9ac260e2a7e6b73d858655d4f00a2667339bec0fb342b64ac958da57199be21dc904056ab2d27a3d17338

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	a66b05aa4ec484259ca0fcb79ee2a57e
SHA1	166784cd6b67814f920695e4079e089a511d8e9c
SHA256	a173cada3674f6e2551e9d58b32820f13fa22169a1a64935a0dc45708e05250d
SHA512	ecb4871b49134e438e1f70dff3d83ab9dd1839218d02b286ce4b9a071731890855d7424735c19ed204c8e277990dd02e944351a5d9b446db8df91be5cff3264e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	a38ccd398b9137db44062dbea71bf5dc
SHA1	c6e32c4398540dfa1e26e1419b47f3bfd03e8ae5
SHA256	93ec4c697f0daff0bed4dc8ced2b03ad24d6ae4805b006c588774e1bac0af32b
SHA512	dc9f7b2f57590f859cfde5eb0ec0a49a14ac920251dc4352f35f05661f46add44b2ac2fbadc900fcb48d49271572255efdde4279f70935666ed099411ad362cb

C:\Users\Admin\Downloads\Ana.zip

MD5	cb6e4f6660706c29035189f8aacfe3f8
SHA1	7dd1e37a50d4bd7488a3966b8c7c2b99bba2c037
SHA256	3341abf6dbefb8aec171f3766a4a23f323ff207e1b031946ee4dbe6dbb2d45a4
SHA512	66c3351ce069a85c9a1b648d64883176983acd34c0d5ca78b5138b7edc2890b34408e8e6fa235258d98c105113d1978a68a15262d6523a82abb004f78b06de38

C:\Users\Admin\Downloads\Ana.zip:Zone.Identifier

MD5	0f98a5550abe0fb880568b1480c96a1c
SHA1	d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA256	2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
SHA512	dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	6707dc4c7c3a6489924fbb740f569097
SHA1	d36274d7ed0ea13bf8a0ff18034ed8d05c4cb00a
SHA256	ead58f83225233a92a4cac1b8f0262f6d09fc0fab978b72e9aa05c7cbe34b2a6
SHA512	67eeb08c5a8507a924350f58e1d7507ee22e924fc6fecb9d650618b23216be7b05791babeaa4c58e0f48b369bddd19cbedf4d2556bdc2603378d4304b2849d04

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	b69a1bb2f921b56b60989f56867aa6f9
SHA1	52bad4059ced2bd4fa4b9ff907d6ad733f487f4d
SHA256	4ba4c5cee67d51fd8e211f18f0558b3d7ffdaaee932cf5591171ef92e6fedb04
SHA512	3580b96140dff97164e78c3281437432df46ea506f5876fbc37b1207434ce63d0652543eeddfcf7dc7c2522a7d11987bf1473728db119bb7075e99574bfa9d23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	680bc3e364e82a149fd9d8382e060735
SHA1	a2427bfaef51628cd0b3826aefeaaec90933967a
SHA256	13ccf6d70c5b51f391f51546ded3ae53236129e1c227b2095332b7d942cec8a7
SHA512	33afe6be5a12fca60820d55c93e687a71410a5ee8addd01002e4ff1e3271cae220cde41ffcf01ecc18a75f2bc7118e11d0091c24f948890137841f72f7f78071

C:\Users\Admin\AppData\Local\Temp\AV.EXE

MD5	f284568010505119f479617a2e7dc189
SHA1	e23707625cce0035e3c1d2255af1ed326583a1ea
SHA256	26c8f13ea8dc17443a9fa005610537cb6700aebaf748e747e9278d504e416eb1
SHA512	ebe96e667dfde547c5a450b97cd7534b977f4073c7f4cbc123a0e00baaefeb3be725c1cafbfb5bb040b3359267954cd1b4e2094ef71fc273732016ee822064bf

C:\Users\Admin\AppData\Local\Temp\AV2.EXE

MD5	014578edb7da99e5ba8dd84f5d26dfd5
SHA1	df56d701165a480e925a153856cbc3ab799c5a04
SHA256	4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529
SHA512	bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

C:\Users\Admin\AppData\Local\Temp\DB.EXE

MD5	c6746a62feafcb4fca301f606f7101fa
SHA1	e09cd1382f9ceec027083b40e35f5f3d184e485f
SHA256	b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6
SHA512	ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

memory/3468-671-0x0000000000400000-0x0000000000445000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EN.EXE

MD5	621f2279f69686e8547e476b642b6c46
SHA1	66f486cd566f86ab16015fe74f50d4515decce88
SHA256	c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38
SHA512	068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

memory/3468-688-0x0000000000770000-0x0000000000803000-memory.dmp

memory/3468-684-0x0000000000770000-0x0000000000803000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SB.EXE

MD5	9252e1be9776af202d6ad5c093637022
SHA1	6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8
SHA256	ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6
SHA512	98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

memory/3468-689-0x0000000000770000-0x0000000000803000-memory.dmp

memory/5020-682-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GB.EXE

MD5	fe731b4c6684d643eb5b55613ef9ed31
SHA1	cfafe2a14f5413278304920154eb467f7c103c80
SHA256	e7953daad7a68f8634ded31a21a31f0c2aa394ca9232e2f980321f7b69176496
SHA512	f7756d69138df6d3b0ffa47bdf274e5fd8aab4fff9d68abe403728c8497ac58e0f3d28d41710de715f57b7a2b5daa2dd7e04450f19c6d013a08f543bd6fc9c2e

C:\Windows\SysWOW64\tsa.crt

MD5	6e630504be525e953debd0ce831b9aa0
SHA1	edfa47b3edf98af94954b5b0850286a324608503
SHA256	2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5
SHA512	bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

memory/3468-711-0x0000000000400000-0x0000000000445000-memory.dmp

memory/5020-714-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~unins531.bat

MD5	9e0a2f5ab30517809b95a1ff1dd98c53
SHA1	5c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA256	97ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512	e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 09:51

Reported

2024-05-22 10:21

Platform

win11-20240426-en

Max time kernel

1438s

Max time network

1424s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\sample

Signatures

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608455693929330"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

NTFS ADS

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Downloads\FakeWindowsUpdate.zip:Zone.Identifier	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\sample

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa3554ab58,0x7ffa3554ab68,0x7ffa3554ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3180 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4788 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4524 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4784 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3416 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3456 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4760 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_FakeWindowsUpdate.zip\[email protected]

"C:\Users\Admin\AppData\Local\Temp\Temp1_FakeWindowsUpdate.zip\[email protected]"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1484 --field-trial-handle=1764,i,16445363494507161671,12791990042410143284,131072 /prefetch:2

Network

Country	Destination	Domain	Proto
IE	52.111.236.21:443		tcp
GB	142.250.187.196:443	www.google.com	tcp
GB	142.250.187.196:443	www.google.com	udp
US	8.8.8.8:53	196.187.250.142.in-addr.arpa	udp
GB	172.217.169.46:443	play.google.com	tcp
GB	142.250.187.238:443	consent.google.com	udp
N/A	224.0.0.251:5353		udp
GB	142.250.187.238:443	consent.google.com	tcp
GB	142.250.187.238:443	consent.google.com	tcp
GB	172.217.169.3:443	beacons.gvt2.com	tcp
GB	172.217.169.46:443	play.google.com	udp
GB	20.26.156.215:443	github.com	tcp
GB	20.26.156.215:443	github.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
US	185.199.108.133:443	camo.githubusercontent.com	tcp
GB	142.250.187.234:443	content-autofill.googleapis.com	tcp
US	185.199.111.154:443	github.githubassets.com	tcp
US	140.82.112.22:443	collector.github.com	tcp
US	140.82.112.22:443	collector.github.com	tcp
GB	20.26.156.210:443	api.github.com	tcp
GB	142.250.187.234:443	content-autofill.googleapis.com	udp
GB	172.217.169.67:443	beacons.gcp.gvt2.com	tcp
GB	172.217.169.67:443	beacons.gcp.gvt2.com	tcp
US	35.211.148.231:443	e2c49.gcp.gvt2.com	tcp
GB	172.217.169.67:443	beacons.gcp.gvt2.com	udp
CA	34.130.135.16:443	e2c21.gcp.gvt2.com	tcp
GB	172.217.169.3:443	beacons.gvt2.com	tcp
US	192.178.49.195:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	54.120.234.20.in-addr.arpa	udp

Files

\??\pipe\crashpad_340_EFBBUFGWGOMDJCMT

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	94bd82fc5182585126900354eb2dda8d
SHA1	5ed3b71fb691610ba4df76117f46828a56a352fc
SHA256	6fa0203baec4d1cd065ffe5d7870faaf04c2f678fdf21d87526adc7823f5c95f
SHA512	da5ec57ce9a762c34a4b9e36a045f22d7f6fc976acb50e2711a2a445ddf5198ec052e53ddbb7a605b5fc988fc11c3e23481199d6b388f78dca9156c7d61f9354

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	d34a9e343d4f2f9b2f80169d310f643e
SHA1	1c545057f4bb43a07d1decc09b951e0cc8f26cce
SHA256	3ee81862e2fc7a90e1beb0f27f83e3ad9a4e93ab76cf4cc5f4e478340eb1260e
SHA512	9e14ad0d7b080f68e56ac7ae85caf2d223ba70afd937fe0556634a155fd0609b4f5dca151b4a7395b3eb281a12f71f695e520ebc62e4467f5aedc106e6e6777f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	abb64cb51336d9fc97ddb294eae84f93
SHA1	f5d11a6b38b17ca586bbb7afcf39515b9ca5a518
SHA256	5dcc2e8e0b8d09174f3d0a83b36a4148ffe552e9d63f6c51dcbdce4e0ee5b4fe
SHA512	d91274a51c8f6638ae032c11d65b24b0bd0d8fc7137767f3d18dd393bb3dda03dc7bc103a3b1336fd9269984154aee23afa50f3cc3a303e6f424401b08b9db26

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5	e6daa0893cf6ac365b5d8d35c8dde00e
SHA1	f3606f65d4167cce6757b8221808c25bae7a06a7
SHA256	23e82f2ec4ec020fdf6dcd68b44f4e63f16fb2eda6b4ac211503c0f11b586bc6
SHA512	83af34528cb70d638a368cfc44ee576070961dda8e0bfd9533a4f1fae55519239524b968114791ee67495fc1c93bfb413da47a743fe182afcbd016bef4078b4d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	a0ff084b2065d90e8b7a421f4a1e3c1d
SHA1	93539f12a70a298bd03ee2d899533217d0218664
SHA256	4abc0c7c1f4cf25170f25e7225eda3acd4b094ccf9d741ff479520785d5157ed
SHA512	d48bb0ee714d2aa44c4e8f20f1cf7e28728fa196690de7f0860b163821db503beb56a472684914d8bea0e354ada80c6e72624bb409e307406be4f7b5ecf1d950

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	d342742388a323c1a74fb2a2fbedef0c
SHA1	88ebf9b91f83f44a7d2c9b44c886951138cc3b17
SHA256	c60ffd4c70be7074d9f2abebd65dc4c8f454c11892ab170f22ca110a03f86fcf
SHA512	4007c76ae83f1120521fd11d2b8542e39c1cf14891c79a16aa6f72bee10d5f88635e1cd59126d56a2163bffb7d3fe80657ef5d58d33f946a996ccf3b4b46a5bb

C:\Users\Admin\Downloads\FakeWindowsUpdate.zip:Zone.Identifier

MD5	fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1	d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256	eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512	aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	59d2944e48e54c34eb693a1861028185
SHA1	c5d6b703f0a17127b9582bc0786fd5d480a7498f
SHA256	35ac8b6509bd94dc6bf42683b6e28d4ef5107fa4bb5cbcbc6567183885fa1d8f
SHA512	55e6f77828e4a9c254c5c1a92dfbffbc0ebf156e8787ee757c85adc9ad32b7d2722e21c9ae7966ae8614fdc97389ce6e796bc5ad162daa333482e2c3c011a52c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	36d364df8ab65d46ed2a20eb90327a91
SHA1	f50112f033d31912ef78c8e284e21ba057ba4e53
SHA256	f9d904c595bd7cd8b5ce79dff42de7b8c98971195ba305e248d28484d4dd5888
SHA512	04bac2626dccebf7520437040804d3b0a5996385b2681585463511139f7dfe95dae07df1b84feacca15b844a717d42f7fa907577d29f784ac2a82ab032905140

C:\Users\Admin\Downloads\FakeWindowsUpdate.zip

MD5	9e94a2a8c092b611420f8bfdbac7beb8
SHA1	38e21ee8cfa81fd26dabfb0923b108b54db6f409
SHA256	8f8f4fba17fdb1538ddff73763cf6bac274f2dd1fd53c4656d45f496ce690f12
SHA512	dc550716d82bbd3f44ad25f67d8d894d94e5cc1e15c996c9a6e3d9fe5fa9acfe5d2b9134736d72c4e2a72434298e6419987319242776e7bd68e0a87783c0fef4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a73d9.TMP

MD5	ff74a85c3334564611729b66ca79ffb9
SHA1	2faf54a8a710d84b36f0ce2fcad52b2edc29fd69
SHA256	1d1ee73eb7752e0f366c3b9f9eb92dc2cc9d89c30358e2e55915d812275401c8
SHA512	eebfad38c39ec141ff8f0e207d6a17589e8a7768a616b4fb8cc515e70ff2ca1eb665fb5caa8390b22a1b6aa16e05147c7689cf881a834da076278f8d005b960f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	215cb99c51f4c8619f13892138ff584a
SHA1	baddef1a0e27c0c78bc559b0e2446ee1080eddfd
SHA256	f475b9e06403911d70702d9e57c38a190941167a819cf283ea73c19ce3f9ce08
SHA512	f3d8bbbc9d46d4c1697958fe92984510a4650b33ea68dfbc15db29a61845b331e8a2ea3b9f0c962362f4c5241cb47c8ea4ce058f0d7c89d6b95d45db9e1cb721

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	051ebff1864b426899428e7a9735dc0c
SHA1	174ec3280493b96203263195021147c1897df80f
SHA256	15a6faf5b5be8770b9d72cc87b40f873fc8c3981db698a0655f7870c2ab64f42
SHA512	ffe70f90ec290ec90cb05a5e44ea3e95d86e1f8322263979489c385f6c288a49e61c3003a438d40beba7e2b17840bdf62a19d0371f7fb20f4d51c4a4e8570f13

memory/2336-465-0x00000000748BE000-0x00000000748BF000-memory.dmp

memory/2336-466-0x0000000000840000-0x00000000008FC000-memory.dmp

memory/2336-467-0x0000000005890000-0x0000000005E36000-memory.dmp

memory/2336-468-0x0000000005390000-0x0000000005422000-memory.dmp

memory/2336-469-0x0000000005440000-0x000000000544A000-memory.dmp

memory/2336-470-0x00000000748B0000-0x0000000075061000-memory.dmp

memory/2336-471-0x00000000748B0000-0x0000000075061000-memory.dmp

memory/2336-472-0x00000000748B0000-0x0000000075061000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	a3df887584763bdc08f66d3aa4b8739e
SHA1	39cd37ce803ff61ac3853b9738ddb061e535611c
SHA256	90badd3457ddf7b730f3bbd64cc4decfb417c02afed9a73ad41ddd34e53e0c91
SHA512	82a3850e8a095c217fb71b7beded03b672bd9b708860bf273c5c756e118ecfb138b2dbd8ee2b75cfd329fc0b9f6f13488c715f0cfddbae0bfc1d33322a50a474

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	2aa2262adb8f685d9b1aa8e87c52cce3
SHA1	912265b20ee19a80fd616c30693f480ee66ccfc4
SHA256	6f63e40e7f1c3a07488433e22d85874fb6f9ae8fc42bb76b26b4c3d60bed3257
SHA512	5546174e1a65f2c9ed4ac3d30e48509c725bfda0bd7971f3c42080e4641043fe7d98ca2f69efe55ed274049029792ec0c017b4881c1260742610ececd450d0e2

memory/2336-497-0x00000000748BE000-0x00000000748BF000-memory.dmp

memory/2336-498-0x00000000748B0000-0x0000000075061000-memory.dmp

memory/2336-499-0x00000000748B0000-0x0000000075061000-memory.dmp

memory/2336-500-0x00000000748B0000-0x0000000075061000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	586e289db719f5061726afab321fcbda
SHA1	3a2fd0a08b1b1288fb150d37e0f31d88c68a664d
SHA256	a2d3014eb874ed67870a5ac4c7470105e27c031c4570d298ce54268367dcfe25
SHA512	94513904adc0f9c5ac5819d87a23e0a9d80050243ac6bee72eade170d8da08d924389a2ac5f8d0b6da5ca7c7ef37d8f75f9b45c9af21dd16caad93f2bba456c9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	32f26aea3e78d41e1fb03fb035649e5f
SHA1	e4ca871b45b1e77bf89b03136ecdc240acf1a147
SHA256	9ee33be09c82f9586eecf052c1c66e63b5e94bd677fb84318b681d2897708dbc
SHA512	a7cc7e5d05d563d72ac640db57fa391407d3037ded7fb2c7dca651550c39e078a14220c1bdea452ecc5f52f01a96c92960a1a38bc55e948f987f2bc5628fabb8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	9d1b3ac6d09effbcf8ca54d61c985b35
SHA1	23c27d50a4fadf0fb1504df279192e885276c49e
SHA256	ed716a7148ef019648d1ecbda5c781d9bb8dc1498399c247a1f42298a2e8e766
SHA512	6fb056b57c3fa823b2ac8e547e0fddc7c771f8b90412ff92f7dd642c2e21149853abe25532df9a1b9166ab7a3a8720bc1793379dd1e855ec6c266e524f8e8eaa

Sample ID	240522-lvg2eabb8x
Target	dugga_848274.seb
SHA256	43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee
Tags	discovery evasion trojan upx

Malware Analysis Report

2024-09-11 06:08

Table of Contents

Analysis Overview

Threat Level: Shows suspicious behavior

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files