Analysis
-
max time kernel
79s -
max time network
80s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19/07/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
SolaraB2.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Launcher.bat
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
compiler.exe
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
config
Resource
win10-20240404-en
General
-
Target
SolaraB2.zip
-
Size
502KB
-
MD5
75873edf6ceb767dfe3aba2b57b83bae
-
SHA1
7a65858d34e3cd5caebf90f1b38a881246815678
-
SHA256
98418f7079cc11970899a18098425d22414663301dbbad1c892a8c702b90223f
-
SHA512
a6842c785536ec2cbe75c5f5d3cb9c2c509607e711e6f64273333e0a9bb1314a756dd96896305485bd97a6bcfe7aa62d1ea4f184c2d1b3d2830d38ce7ed50b74
-
SSDEEP
12288:7dyZL492b4zQsxy16KgB1+7+KBK3OvLBGsY4NqQqdVBlk9:7QZk9280sXB07jBK+C4NqQqdnlk9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133658790987188487" chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 872 chrome.exe 872 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 4828 chrome.exe 3916 chrome.exe 3916 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 872 chrome.exe 872 chrome.exe 872 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 872 chrome.exe Token: SeCreatePagefilePrivilege 872 chrome.exe Token: SeShutdownPrivilege 872 chrome.exe Token: SeCreatePagefilePrivilege 872 chrome.exe Token: SeShutdownPrivilege 872 chrome.exe Token: SeCreatePagefilePrivilege 872 chrome.exe Token: SeShutdownPrivilege 872 chrome.exe Token: SeCreatePagefilePrivilege 872 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe Token: SeShutdownPrivilege 3916 chrome.exe Token: SeCreatePagefilePrivilege 3916 chrome.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 872 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe 3916 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 4828 872 chrome.exe 77 PID 872 wrote to memory of 4828 872 chrome.exe 77 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 1828 872 chrome.exe 79 PID 872 wrote to memory of 4216 872 chrome.exe 80 PID 872 wrote to memory of 4216 872 chrome.exe 80 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81 PID 872 wrote to memory of 1476 872 chrome.exe 81
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SolaraB2.zip1⤵PID:3192
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:216
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ffa3dc79758,0x7ffa3dc79768,0x7ffa3dc797782⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:22⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:82⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:82⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:12⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:12⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4468 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:12⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:82⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:82⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4936 --field-trial-handle=1884,i,16701638782865650127,4231221942582733499,131072 /prefetch:82⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa3dc79758,0x7ffa3dc79768,0x7ffa3dc797782⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:22⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:82⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:82⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:12⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:12⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4392 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:12⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:82⤵PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:82⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4896 --field-trial-handle=1860,i,2745237551072411589,13125046309161080568,131072 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD5e0dd52af85510fa1ed1eae10b41a1b3b
SHA12c9ee0017c0e6a97e4a22bd7892df46965c6a642
SHA2567ef6a188eedc4d8e0c2660e0d69b0b56894b7ba3cbb76b740d92505802485c49
SHA5129f5578517d477316e2292e9a8dcb47881c739b4b42adab75fbea4164088dcb09df007874fdfc24bfb34967640ef862d28fb4b205837be151a4e2ad2306426cdd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\6e85ec8a-d27a-485c-989f-cbab53bd30f5.dmp
Filesize1.2MB
MD55423210794782a6387e6da8651f3b4ec
SHA1a67377f58204563548c230399f89a91300aef3df
SHA256f0a39abb896b6729001133bd9add5b15bb7cf3e7a6ee68c623a4c3caf39414b6
SHA512b49e49a4fc3a8fd2de62b9b9918a5091072fae864b90e925910074d199c1e4d48868e30a5dbc43d368b0eaad4ec7f4a3dd0eb7b0695d5e1af509de91d86ac239
-
Filesize
40B
MD5675cb66bf44402292c9f513e881cfb31
SHA1d386b8b985974dbcc333a5b4c4d6b249a7ba649a
SHA256d34eda46ca4c4455ea9ab8434b3306eabebe0fe1eb4742d10d0d7e3294e31025
SHA5129891cdfc97ffdb629392f22423daa9026265bf38db0728263a3ce41e2357a25e50577cf81ca79570915dd0fe4e43facdfd97b3165e3fdd80b4d6d3c910aa4c06
-
Filesize
44KB
MD5032e6fa6009e12b6e3126d48501f6e34
SHA1e32383c155b0a40fa91cd94c15b4868a945d56fe
SHA25677dc4c3b72e551b73e10215436b86692c5cbef6be2a95f573a84bebb52a5e363
SHA5120a6ad1bb8802a5d2458b7a7ce35c02c35ce780cb7d695a2ac4c12a0927de55605400f280d318ab81e37a36c9ac0ba1d5036bfc939283ab8f3a1fa3bc079a9d7c
-
Filesize
264KB
MD5e6f12a5bfff112fa4fd68d9c348cd7a7
SHA11214ad6d4f7fef7ed86de2039f62196dfc454aaa
SHA2561aa95bc2c2089dfaf1c3c266f45ee0fb37f4a4fbada176bd0177f92216ea9b7e
SHA5126a24367c1a259f4870882a189d3dacfd719df2eb15a85d7aca58bcbf96393e53ffd73aaf8a6e4286cd1f5775165c5d26ac43a38c564d7e1d1e913469df94d683
-
Filesize
4.0MB
MD5e10e6cc724935dda4b99c213448f3aab
SHA10db6fc1dbc72e2b6149892c349c842874ad25804
SHA256938b3f8f974dbe00ec1e618f0d748e7b6db4dd3cf452cb28f5c868e4d4908936
SHA512ad5206368734e5ed4a51adb04c31d227913a95fc972173be38d444ca8cfcf106cb4c2fb2c4d3f19d0a9162d51160c74cdfce8708220653268572ce9729d9c84d
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
Filesize
168B
MD56008217f67d61b14f4574f473e5488eb
SHA10475826f07e90f243f34b1b8f7ccbec9709030f3
SHA256e881e402def31e6e6372f8f0548b2bd31ea0f669de026ca6bf273910d293f758
SHA5120c0e1167bf7093576deec6d9310494a3e2a9fef63cab80d03507de76ab13eb09849c9e19fceefc15c6a1a114836c6ecdc9a34d01b09880983a0ec54c538aa173
-
Filesize
320B
MD53aba641c67e0dc24de5feaa81e5772d1
SHA15f36d15805c86939af112591367bec991ef01762
SHA256a166f8ab120203bb62382dddf3def4a2cc514c8dc131a05eef69228f9389fcfc
SHA512f1cdac579250d03eec4ef0e100eaea25338cbb4734981b68497e6b6212a737c0725e877158bb9c3ff4179957d448b5efb3a3e66c078288b318d8e5bc097203c4
-
Filesize
327B
MD566fccb8a202ffa82c7280022c9aeafde
SHA1741cf3011bfd0266032515a161899264ec0753f7
SHA256a1b79c6bb629009ab32d1785e071e2383f09c8cc0211529ac72ceaae8e8a9802
SHA5126c2159dd13c631c41e5e22ea2f9f71b6c912d39b4e2d89ebf4f298652c3deeaf5ef61ccd455075bbcf009ab2dbb88a372083d81c23ab20c4263d83239358c597
-
Filesize
329B
MD53f3c16c1bd905c74687e9e2f0c1ee3b6
SHA1b5edb4c577976751d7c7b700a8af0d6a1193c5df
SHA256494190d20b17622e9681b4e29c855f8eddb3903d62ba8f9c494d773d13819107
SHA5127a7b813a5f5aaf485eb984f2140c3f0a2acfeb7fae4b44c6f70a1b05a930066106bfa088e7e25a70fa08c9b821bf72fc8731de81465139f423f256a16bfdf1fa
-
Filesize
1KB
MD50de50477b875133fc81570eb2d29dda0
SHA1ea26c0cfa62328498449a9132ff9c827b2b0303d
SHA256253c755e10b697df8178b699884fd43a7784a3bfc02674f56471abcafeb926ba
SHA512c31ab557af6dfb2caae9d08bafb39a374e54a20b66d3efe94203e2102e6286a8c167610de991f1ebf7f76e45a47df0e93103c964ee00c0c44e1388f169158a33
-
Filesize
371B
MD5802b1e863ab0c8715b546f19640a55ec
SHA1fafac7d877e6e9d65aed07fed44d6d9655aff93f
SHA25681e2c5258d5639f2e914f2d98fd056230ebbf74bb7886c567ebbf0198edc99af
SHA51224b7f0e823978064cd21795596baace729f4a31d597c27529ab3900844842712273d689087f9780744a34213bc2d9233deeeee11d7aaf5e2a3456def36767c27
-
Filesize
371B
MD5b1336fe9665664b334c04126c636bb4d
SHA19d633d3ca32540d66889d7f2d84e9a9d303c5cca
SHA256c825bc4c36992ba7bd20c95722fd7fad2fc5b773cb1fa6f0ad88600b48a6aeea
SHA512ef8d2bd8eba7496156272a0de008c69bdef3290698e8510bde440dd71420320d8fb92d1a68dc9ffd2d7810febee8af3084f4c800fda2dc1a88193c973c8c98d6
-
Filesize
5KB
MD516e5eb1fd14c585b60bc53d9f3087e19
SHA193d66575479810433ddca0d59ffccd22543e15f8
SHA2565f176a4bdc2a5de66e0a605c9b90466137707ba66c84c61cab47b236b89a1c2d
SHA512f495752705f273253ca06ad178eba45d021e742f3be11460f2fc9f2231a34471d69171bdbde033f4b9b6a6cbb6d3b151029332d6b8c8e426bed3cc8176b7d4b2
-
Filesize
6KB
MD5faf5ed8b349f1da71ccb0de98a6ac36f
SHA141647bf1ee1f0829defa7cfcdd5b1945ccf2880e
SHA256d55f4dc65f016248dc0620ad2adb4c02817e9415a8b5f4695aac75ecb5e0fd54
SHA5120ae653a5734fecede296393c77aaafdf1bd613bccf9886fb7a428fc35b7b8017d3d361827c1af78e408774155a754eb5a569995a083f7b4dbea3e9350554caa5
-
Filesize
6KB
MD5089c7b1ab2e7bb8f7c3cef8ce7751ad6
SHA19b2074d284d5655d37ca02e7309f154ca2e0792d
SHA2561174cf6e81e93aab1bf894132c74527aeae8dbaab893ef4454037fa000e59515
SHA512c1ea0d2f9ea3ad8bd7a7438da1b8d50ed712defc73077c5f66f09d742eae8e8bcf89a58abf6630bf6336742c46d97ca33e5df9b88d3e6a5a4a00aa40d95443eb
-
Filesize
12KB
MD5b8c5534641dad92f652d60aa862b333d
SHA1451be3babfdcd02a59180aff77783d80ea4edb89
SHA2569952220c8ef4147afbc9e98cc310ca6acb5e0ec1f4c1544638cafd52416254b2
SHA5127d1434b62636d0706070072fff2ccbdf15d73cdeeef81b7daa9414ac73818fb0abb7121ca477a680cf72f6884d8bfe80f500bc40b955472c3e4a372b976a09db
-
Filesize
194B
MD5d7d9437445aa960dcea52ffe772822dc
SHA1c2bbf4ac0732d905d998c4f645fd60f95a675d02
SHA2564ff49903bec1197017a35995d5c5fc703caf9d496467345d783f754b723d21c1
SHA512335eb1ba85670550ed1e1e4e14ea4b5d14f8306125bf147a42de4def5e5f75f14c422b014414030cf30378c04f748ac875cf056adda196511a0b057b3598fe9a
-
Filesize
317B
MD57e16cad4de7c129d3f0677e61b65b687
SHA19fee25044d493213bcee529bc5eeeb51878b0cbe
SHA2563f58da0967633e957c787da4df57588e2632ee123a6d85b0404b709724c1a635
SHA5127684c51339352c57a1500ab7b50c7bbf61c1985b11538249095b4f980b6b6fe0f48bd6a2772b814cecc2f01a5826050bb460da30d525715f39ea29228bc240dc
-
Filesize
2KB
MD5cbf05d61819f0d10cd40ecc15d8d9a97
SHA12e479cda5456fe77b31717148eafb409b632255a
SHA2563be3cf37042c8391656f4ce65476582cfc47e9f7c3897b8b3fafc2b63541174e
SHA512c10a6a487b48311fb6e134a28e2014b7260d40b40b5619e40f0a4d265152275e10d7b1320832520e1c79d7dd2639d77a1447e98937a44c09a6a1c5f84d2e92c1
-
Filesize
348B
MD57f4e3bed29074c42531ce32b2cbf1205
SHA17052c9bd7b9e369f33f6ad0a83249e916ba85d41
SHA256eae07085e8ec14f85cdf7883ba6f3d6194e7352bd09284780f1547c61a6a959d
SHA5126503e9c34db7979c4f82038ab71e885d405010fc5c6cbc81b882359e5d31d360fb0868b291d1c5a6e35208515e252f8f717f36262540de242e26beef5dd7ebb8
-
Filesize
8KB
MD5af3520adb8c7e6f67e7c7da194a32e24
SHA116ab88aae466c87481927d8e69706674dfb0e811
SHA2565aab39176d2e4bd06372565ec4fe5c3eed4714317115790582198681ca9de8b7
SHA5122a10475088d6732968592c66ff450ad9613513ad0334649c3177e842eecb95d6c4e69cab8fe0cff13bd4bf6a5d474a7d4df7705e00f778396a1ee09e7f7abfa8
-
Filesize
321B
MD5879a5c3cadb6bfb32a065f8ca54a96a6
SHA1c5bbf4b3e6936b0bf4292c5e4c6ff69d56395b24
SHA2568dda8195624fc4e158dec115c26c9ea7937bdb868656d32a2d4b8afe9417de77
SHA51264a038f203b136578f220dc39a5c30b4cc851faa7c195615417f58c98837ed19cd40b5d51b82e285421ef08520284f6f07cac1ffb768dcd77ca98ec857b5e9c0
-
Filesize
843B
MD581d335b64b66604457001bd19d52ebb3
SHA189a27413836049f67e645875b134970bad4bcc83
SHA25643dbf3685cef164237192417610bf306609beab6044828803f55c05446682249
SHA5124e6b6bc1deaa55408ea64e0ac1b79830f06e56137e9a2011e023ee74fc6217ff74e4d76540039055e50b594b80c286f87dc2576ae2bd7dd411a2b2f6e5628a0c
-
Filesize
320B
MD5de9c679993926e0f6fc6f23a606f8a2d
SHA1dd9b3b0ebc1f18504d4cf32543e6b22fc275b5e9
SHA256780c255b8a7fbd027ff78073aef861d498f2f61775e4b9a0efa5a59c210d188f
SHA5123a11c22392d8683570b569d40b68d9dcc9d80d3952996a5f2946164e5b2b88b3d473dcf4b993817b8d93028f6070d3e1044be9824e1fcf2d5fce46af759143a6
-
Filesize
860B
MD5eeb01e8810f464dfb58d3f992d455595
SHA151b6aa353f38d4220f19e2203fc7d41ef95f72a3
SHA256a2233e8c6bd6df5ad16e6a927b81a95c0af709ac433aaeb18ceff5586506f4a0
SHA512fc813974a7e2da64f258f021e8ce054877e26fb03c74a2ed6a8c0a027b64130648556d821004bc798e4365b0ec4ece0abe6e9ed225e2526cb210a3ac3479503d
-
Filesize
338B
MD5528e0cfc263cd9e0965f16af82925084
SHA13da5721d136cad9adf803bf3389d850c5d9de3a7
SHA2566a8fd4bfc6681e47e1b03f5608312963b2420e987a3e46694c3afbe5ec27bf40
SHA51249c4039c4cdd682ea3b43df96f5763fbc697f4f13e0125a3bf64faf735847fd1229d2b5af515708100f7934437438f9684afcc5805145e1147991bf87c9a98a4
-
Filesize
44KB
MD57c1cf1fba846e97ea06e8b931b9b2bc7
SHA129e14b06c8f022598969d3d0576d33143b75f7cb
SHA25613fe9a0b78b096d038d928aa6979808632ee08e47cbf5a5ce079af879742f07d
SHA5129fe710f4432fcad132d9b5652fbd0b83670779b305fbab26a5f76aec1f839cd1f551749f258e0031f21243a255e25cc67a961a4a7adcbe0fd288d1e4e6f3f410
-
Filesize
264KB
MD525f39bac99c57f73ccba05718d3f0dff
SHA1621b5ba1d49e37b62a1e2774b9d74f0eb9332554
SHA256a53035a7bbd80fd1cdf52a159c600ceed81f2b8210f8b2ecdb5c630f33bf8de9
SHA512de9cfd2e7ca275edf60511e0e88e285fbf1a3dc74703c779880a521ef7a9050e3886f86ab87feff875cd3f53aeffe5e562c72cb97b70de0804d1883b80a4b51a
-
Filesize
4.0MB
MD5e3a1219f86702595779460561ab6ffc0
SHA10e9f8dde9249cb476de689cf4d98f466def91275
SHA25613a5354e92ccb7aaceaedf49051964637f1be9a9acc9d9096fa9d2918f85d7da
SHA51290fd80d4251566f57a8774da76451f1a8521366dbf4d4c229daf7c021ed1a8474770de4c36a63814b3143f0c4ad1605ab377f46036344ece96414e5fefcb9183
-
Filesize
106B
MD5de9ef0c5bcc012a3a1131988dee272d8
SHA1fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA2563615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
SHA512cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
-
Filesize
14B
MD59eae63c7a967fc314dd311d9f46a45b7
SHA1caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA2564288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8
-
Filesize
290KB
MD575867c54e8144717a997fede35516139
SHA1fda2c032ed2b449af9ef974a88c7d70b0131fb6a
SHA2561f0b8c06ad97e1854c5280baeb7bcb03762a49fbe69dbab65b22f287430ff16a
SHA512ed347cc729cb90922c8243066e2cdfd17c0e3ed0e2acea17f654492efd2642a64e47646f2a5657bd983399a3758901964faf6dd2a469a5c301f65a27c14f5bc7
-
Filesize
290KB
MD58f65555dac6a55471c0c37912aa3eae3
SHA119aea90dc48a3e231fb24e332704663a1fa41a86
SHA2567b161f153b21154eb6d63aa650a90d1f2018dae4ec3a3a76c2b859405abe0b81
SHA5128b8064ba0dfd1db3e82fc4c7b480a6b3f8f1b0d68db078244fe746a6076ac1db3ffb8957f912f5342a8a35411cfba95be6d78bb79cfd9461d6c9ae8c4716a1e1
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
86B
MD5f732dbed9289177d15e236d0f8f2ddd3
SHA153f822af51b014bc3d4b575865d9c3ef0e4debde
SHA2562741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd