Analysis
- max time kernel
88s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
General
- Target Loader.exe
- Size 490KB
- Sample240613-vyp1vsxcnd
- SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
- MD5 9c9245810bad661af3d6efec543d34fd
- SHA1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
- SHA512 90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
- SSDEEP 6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
lumma
C2
-
https://cleartotalfisherwo.shop/api
-
https://worryfillvolcawoi.shop/api
-
https://enthusiasimtitleow.shop/api
-
https://dismissalcylinderhostw.shop/api
-
https://affordcharmcropwo.shop/api
-
https://diskretainvigorousiw.shop/api
-
https://communicationgenerwo.shop/api
-
https://pillowbrocccolipe.shop/api
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627731272775627" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 376 chrome.exe 376 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 376 chrome.exe 376 chrome.exe 376 chrome.exe 376 chrome.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 2980 taskmgr.exe Token: SeSystemProfilePrivilege 2980 taskmgr.exe Token: SeCreateGlobalPrivilege 2980 taskmgr.exe Token: 33 2980 taskmgr.exe Token: SeIncBasePriorityPrivilege 2980 taskmgr.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe Token: SeShutdownPrivilege 376 chrome.exe Token: SeCreatePagefilePrivilege 376 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 376 chrome.exe 376 chrome.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 2980 taskmgr.exe 376 chrome.exe 376 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 376 wrote to memory of 3148 376 chrome.exe 109 PID 376 wrote to memory of 3148 376 chrome.exe 109 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 640 376 chrome.exe 110 PID 376 wrote to memory of 412 376 chrome.exe 111 PID 376 wrote to memory of 412 376 chrome.exe 111 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112 PID 376 wrote to memory of 4124 376 chrome.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵PID:5060
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2980
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:912
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffca3169758,0x7ffca3169768,0x7ffca31697782⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:22⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:82⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3304 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:12⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3812 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:12⤵PID:3428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3804 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:82⤵PID:5192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5272 --field-trial-handle=1992,i,2924767082069182974,18022356504894058766,131072 /prefetch:12⤵PID:5388
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 369B
- SHA256 96b2b7f74c57d1923c37a5ee91a5cfb98c2872f7931d03edd96a851e6ef55be1
- MD5 cff992fd6d0e6c369eeee260374e3fb9
- SHA1 333b7065545270fd8dbaaef973b30ff959711127
- SHA512 0f27e8e2acaa941b7e8283955e66c5c30eb4559a401eb7c2b7546975033ef88ff0908fffaddb4c33875686a5461d0a9598bfa81509408fc0c7caa3b2f260998c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 f964836cb85b1adfea5cfcd8a670602e431372c6381135c1e91f842ff0ec4286
- MD5 51e986ffc4118e5d0a33e70d8826af69
- SHA1 491d1e556ca1deb586da4d2e2518dba0d570e07d
- SHA512 4482e23056c17bc4a257f5538b49d624da7f39369864a06c7f631ef30a886ac8f82f58048d73864ecd2485ebadba4a29f571db3d4aacb91a9b842fa5993bc2a6
- SSDEEP 96:sJBICKIH/rqd8iZRy7Di+6Msmde1IO1YejbjVhYtjEsXt0/cg2Vup:sTZxg8syy+FERbotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 276KB
- SHA256 77798ae04df1159f52bf09da5e7c777a6f452bf9988ce71979c338f22efabae1
- MD5 d24eba99aeac634b6d624d53587475c9
- SHA1 c549561cffae266c47af5d156a42942e0c62ae31
- SHA512 b785acf355b448f503a7708c9d1d839dc529a738324dad4f23c60fe245759c989197addded812b6ec49c507ca37aa4d1f94942075290961b050d85881fdd6951
- SSDEEP 6144:jz//OIs/6/PNDvSpYrMVF0H91iASNdvXCNpbMHtCMpSG:jz//xs/6PxAY82fiASNdpHtX3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512