66a1aec8c3669c1c2e13625849996ab09a81a4df712e8ce6c88d025d110cdad9

Analysis

max time kernel
600s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de
Size 16B
Sample240613-p1m2dstcml
SHA256 66a1aec8c3669c1c2e13625849996ab09a81a4df712e8ce6c88d025d110cdad9
MD5 7b5ea53ba332630e5aca8e4abb807f70
SHA1 d78ce9bb512ba2daf191b2d02729ba41ab1924ee
SHA512 ea85ebf524b655672b32c2ef09f178f11ce03979ab6084c8bbe769ade162605e133679d854643636483a73a82763d2e40848e212e8fa571ae1f7c6d4b04ba862
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627565596028432"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4436	chrome.exe
4436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2116	4848	chrome.exe	91
PID 4848 wrote to memory of 2116	4848	chrome.exe	91
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 1044	4848	chrome.exe	92
PID 4848 wrote to memory of 736	4848	chrome.exe	93
PID 4848 wrote to memory of 736	4848	chrome.exe	93
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94
PID 4848 wrote to memory of 4072	4848	chrome.exe	94

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\de
1⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff98260ab58,0x7ff98260ab68,0x7ff98260ab78
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4060 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3960 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5000 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3092 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3640 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3332 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3092 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4776 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5016 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4464 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4260 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3204 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3376 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1108 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4276 --field-trial-handle=1972,i,10121500102460758008,13098827136509733326,131072 /prefetch:1
  2⤵
  PID:2996

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 af21451171d0ea760419383cfa28e24eb77bba04dd4c5dc9117eefb1ee87ce91
MD5 65ab7ab1d3f5a098795ef9c7484f4bb7
SHA1 defb7bf3c80aae03e179e40c029c6de46a912c04
SHA512 ea216b9d1e8682c82afa617f277306a54529bca83a7eeb2668d7e315cdf9f4e5fd1fcc46eaf06472aac939abee7645039d5029ae8b9939f212557cfeeeace907
SSDEEP 192:qow8fyXOpOjAE8aJq8syh+FClS5rIjgjN+P5tjEsXtScR:qow8fyXOrggyq0S5rIjgjN6tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 1ee1350161ee63e7eab5b49d0534dc5b2a0916d1e396620191774e7105668f1c
MD5 000926892a2230a3844e2c17a494e144
SHA1 a1cdd1f4c7f40f09c215c98739cec49e0a2ab1ff
SHA512 6fd281cb0fb8036b4fbbbd23aec20292db4bc45a50d9691648ebfc99272eaa224d2ce08c5779d539d364a03ce41e20c2c0bf33c2f42e44f4dc9199cd31188ac9
SSDEEP 192:q6wcc2kJ2fyXOpOjAE8aJq8syh+FpFLhmS5rIjgjN+P5tjEsXtScR:q6wcc2fyXOrggyqpJhmS5rIjgjN6tIsb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 ad81a79047d31c1d6cf39ab0091b8693dca197031d953685106c3a27954c0738
MD5 7e58171843709daa15fb7bae5e51832d
SHA1 2582458128f1354659b3b165b250b8b9fb440cac
SHA512 2525c6273a600f3b3c612058d94248a1c6b49a17d87105ccff7ea84b0be76531614544f5590cd369b3b465ad4a3fdc7539c6eeb9e5f75da44783bd56adaa2f0e
SSDEEP 6144:uFZ5IZXqXHjTdCP3y/fQYRPILxZnhLMJjX0EeGzY2rLf:QsqlGSfQ5fnReEFsLLf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 e14e0cacf418c4ce96a180347de6a27d233b0a7b49ed861d8292e6addd330208
MD5 ef6f01b17880815e69de9a609c338814
SHA1 44c35a036016f47c7bb3a70b0a26b55ae2b0b090
SHA512 f5c906c1c3829295d08559f9ad4617967cd0ccfc11d5602b5fd6d6b37c7aead1a835cd3a438c180c23a9991c67db5e1ca8602595f7a164fc68cd963a6dc3fa17
SSDEEP 6144:uEZ5IZXqXHjTdCP3y/2QYRPILxZnhLMJjX0EeGzY2rLf:PsqlGS2Q5fnReEFsLLf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 71e8efe227ffdf462bac50aeda19432f889004eb129d98f41067c665c821d8eb
MD5 426b28bd0e53b33844201c6089cd7278
SHA1 59d4ff0ffb52b13f7cd51179089618ed2e967119
SHA512 2201e95d86d4bbc8c716b61f7bf6ed08c36292bf91be74a9727bc02ed8caea7027faae6bbd23b25e0623ad3a47afe21dd5af7c40deaceada03caa7c54a9a2470
SSDEEP 6144:uiZ5IZXqXHjTdCP3y/2QYRPILxZnhLMJjX0EeGzY2rLf:JsqlGS2Q5fnReEFsLLf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 92KB
SHA256 ac95e9966e1f4432e4ffe76b6b32cbdc0ffed94abd8e178e27447e00f450a788
MD5 fe4e4bd36dbd2d393398dd7684f663c5
SHA1 ecc73172f98cc83817fc643a087c95d3c55518a9
SHA512 b433ba4610c2d29b56733eb9bbf5c1827035f1b302df80fdf98957fb5899a589b1d1c90017de1d2cb8db08326034ca3624e53520dd49f3b3df6903df9bd09ffb
SSDEEP 384:zxqXxEQDH1/hH0eac+XH5b+pfrKMHERVbqw5qhBD1QOYbeJrul5HAkibx1lziCXH:6iQUgb3+lF98/VQuKq+N4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe58c1c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58c1c4.TMP
Size 89KB
SHA256 a8f7bf66efd56e8cabb8bedda6e6f23aa22dbc498690a3e7b0c9bb4beaea6c10
MD5 ae06548ee11d4e11bdcf606c83fe4880
SHA1 636109e61b8ba57d51c29c509497cc3bd7cbda79
SHA512 18217d956fc1f69f6ece5df459fc3f3ce96ec48fa087e28f46bfabdafba0a91a056f2042c14e21bb002bcc6b90c285a210c8a9ca4057d85b3f0e0e7d3ce1f2eb
SSDEEP 384:RxqXxEQDH1/hH0eac+XH5b+pfrKMHER6qw5qhBD1QOYbeJrul5HAIbx1lziCXlrO:oiQUgb5+lF98/VQuKq+NP
MD5 SHA1 SHA512 SSDEEP

Submit Download