Overview
overview
3Static
static
3New Compre...er.zip
windows11-21h2-x64
1Kiwi X/Kiw...config
windows11-21h2-x64
3Kiwi X/Kiw...config
windows11-21h2-x64
3Kiwi X/Mon...se.txt
windows11-21h2-x64
3Kiwi X/Mon...nc.txt
windows11-21h2-x64
3Kiwi X/Mon...lf.txt
windows11-21h2-x64
3Kiwi X/Mon...ns.txt
windows11-21h2-x64
3Kiwi X/Mon...lv.txt
windows11-21h2-x64
3Kiwi X/Mon...6x.svg
windows11-21h2-x64
1Kiwi X/Mon...6x.svg
windows11-21h2-x64
1Kiwi X/Mon...in.css
windows11-21h2-x64
3Kiwi X/Mon...te.svg
windows11-21h2-x64
1Kiwi X/WRD...F.json
windows11-21h2-x64
3Kiwi X/bin/settings
windows11-21h2-x64
1Kiwi X/bin/ver.txt
windows11-21h2-x64
3Kiwi X/bin...rs.txt
windows11-21h2-x64
3Kiwi X/bin...ts.txt
windows11-21h2-x64
3Kiwi X/bin...rs.txt
windows11-21h2-x64
3Kiwi X/bin...gs.txt
windows11-21h2-x64
3Kiwi X/bin...4.json
windows11-21h2-x64
3Kiwi X/bin...s.json
windows11-21h2-x64
3Kiwi X/bin...er.txt
windows11-21h2-x64
3Kiwi X/bin...op.txt
windows11-21h2-x64
3Kiwi X/bin...re.txt
windows11-21h2-x64
3Kiwi X/bin...es.txt
windows11-21h2-x64
3Kiwi X/finj.exe
windows11-21h2-x64
1Kiwi X/log...ash.js
windows11-21h2-x64
3Kiwi X/wor...age.js
windows11-21h2-x64
3Kiwi X/wor...IDI.js
windows11-21h2-x64
3Kiwi X/wor...ler.js
windows11-21h2-x64
3Kiwi X/wor...ise.js
windows11-21h2-x64
3Kiwi X/wor...til.js
windows11-21h2-x64
3Analysis
- max time kernel
119s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
04/06/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
New Compressed (zipped) Folder.zip
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
Kiwi X/Kiwi X WPF.exe.config
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Kiwi X/Kiwi X.exe.config
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
Kiwi X/Monaco/base.txt
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Kiwi X/Monaco/classfunc.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
Kiwi X/Monaco/globalf.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Kiwi X/Monaco/globalns.txt
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
Kiwi X/Monaco/globalv.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Kiwi X/Monaco/vs/editor/contrib/suggest/media/String_16x.svg
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
Kiwi X/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Kiwi X/Monaco/vs/editor/editor.main.css
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
Kiwi X/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Kiwi X/WRDAPICONF.json
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
Kiwi X/bin/settings
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Kiwi X/bin/ver.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
Kiwi X/bin/workspace/Blox Fruits Fruit Farm/Empty Servers.txt
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
Kiwi X/bin/workspace/Blox Fruits Fruit Farm/Servers With Fruits.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
Kiwi X/bin/workspace/Blox Fruits Fruit Farm/Total Servers.txt
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Kiwi X/bin/workspace/Fruit Farm Logs.txt
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
Kiwi X/bin/workspace/Mukuro/BF/kiwiecksfruits_3897567374.json
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Kiwi X/bin/workspace/NotSameServers.json
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
Kiwi X/bin/workspace/Self Bot RMA/saved_admins/Enter.txt
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Kiwi X/bin/workspace/Self Bot RMA/saved_admins/ExtoriusOnTop.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
Kiwi X/bin/workspace/Self Bot RMA/saved_admins/Here.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
Kiwi X/bin/workspace/Self Bot RMA/saved_admins/Usernames.txt
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
Kiwi X/finj.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
Kiwi X/logs/02-10-2022_00-54-09_Crash.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
Kiwi X/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/package.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Kiwi X/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/MIDI.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
Kiwi X/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/TaskScheduler.js
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Kiwi X/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/Promise.js
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
Kiwi X/workspace/rostruct/cache/releases/richie0866-midiplayer-LATEST-ZIPBALL/src/Util/TableUtil.js
Resource
win11-20240419-en
windows11-21h2-x64
General
- Target Kiwi X/Monaco/vs/editor/contrib/suggest/media/String_inverse_16x.svg
- Size 4KB
- Sample240604-rst6vaac2w
- SHA256 7d23c0f30cb9c05c81bb15785a3299772ae3cfbe51f3e04895aa1f23ffbeba5b
- MD5 6e5c0ce7ec09969f07ea6ee078ef8ad6
- SHA1 deadc5357a26852d872bffa77d1aa19108603b25
- SHA512 2b02cb82f9e4720ee43bfc8b7fe5d6de38228329aafbedb589d5a219057c15f073023deca3c1ca5b65cea4a4f0d863ebd88c889b1d67119639fae2ce180863bf
- SSDEEP 48:Cn7wkEX+c9Vlt4AFCj93Z0hDC7hSBnukNyhDFtrJGuG2XvS+yZCahDC7hSBnhKHG:EJWFCMcfkCFGE6+yZCacJImkArbbqrAm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619849485286260" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe Token: SeShutdownPrivilege 4588 chrome.exe Token: SeCreatePagefilePrivilege 4588 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe 4588 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 3472 4588 chrome.exe 81 PID 4588 wrote to memory of 3472 4588 chrome.exe 81 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 1124 4588 chrome.exe 82 PID 4588 wrote to memory of 4868 4588 chrome.exe 83 PID 4588 wrote to memory of 4868 4588 chrome.exe 83 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84 PID 4588 wrote to memory of 1444 4588 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Kiwi X\Monaco\vs\editor\contrib\suggest\media\String_inverse_16x.svg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe0b44ab58,0x7ffe0b44ab68,0x7ffe0b44ab782⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:22⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:82⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:12⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:12⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4260 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 --field-trial-handle=1820,i,17593514289594803872,1422541964835912439,131072 /prefetch:82⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 caff0f3893638007eb38b833b85203b3a78b259d4592c77681b14cdab745925e
- MD5 7367c010c59e25011a1f21ed9731e1fc
- SHA1 5f27baebdb3910dfd2c8b64554379cf7eb92949f
- SHA512 5670aac072e9cac2ba87466c7c2f8d30916c85f1509b8ca6523580144abe5ad57a76139da4c7bdabe5aad2d27c5988d85d86e7f9b6d23c5d4172372d36a8ea84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 11cb7ef065ebdc7171f2e8c5ce8535fb032437ee37346cc79fb2de877ab38b5f
- MD5 5422cc2540b69f89b6e209c835fa520b
- SHA1 8e4e87c43910280d8d9afc4194e823df6e22f79c
- SHA512 62c5b774a9c676f3e6e09de1e7670df28f98aa78fd536e4bb736fdf710873e09d350c935d87f5b597b242f38a1e3d161b4340813bdf0c2ce68e705b3db337278
- SSDEEP 192:AwcXyhEa2/baJO8syh+FLl9SlM8UvvP5tjEsXtScR:ANXyFUyqPwCRtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 129KB
- SHA256 a91a7ad1615f54ff3ae8c2c985716b7d7686d7a73022caba2f943162228afde3
- MD5 3ab4ca6b1c494d3b7f4f478c8acfdd0d
- SHA1 c7e5bcca1f0b07a229bc93be473c8a378f3c699b
- SHA512 d6fea493a11877535e0213cc915e4c8293eb05ec9ae37dbcab8ce8c4bf5d9a6558161e80ce5d29ed10dffcee505bdff092977243182d64206f7331a1a4db0abe
- SSDEEP 3072:wDJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTysW:wDrI1Qo5yzkpeXjnJFzXsWj
- MD5 SHA1 SHA512 SSDEEP