Overview
overview
3Static
static
3BetterFold...er.dll
windows10-1703-x64
1CeleryApp.exe
windows10-1703-x64
1CeleryIn.dll
windows10-1703-x64
1CeleryInject.exe
windows10-1703-x64
1Costura.dll
windows10-1703-x64
1Dragablz.dll
windows10-1703-x64
1MaterialDe...rs.dll
windows10-1703-x64
1MaterialDe...ns.dll
windows10-1703-x64
1Microsoft....re.dll
windows10-1703-x64
1Microsoft....ms.dll
windows10-1703-x64
1Microsoft....pf.dll
windows10-1703-x64
1Microsoft....rs.dll
windows10-1703-x64
1System.Dia...ce.dll
windows10-1703-x64
1bin/Monaco/index.html
windows10-1703-x64
3bin/Monaco...ain.js
windows10-1703-x64
3bin/Monaco...tes.js
windows10-1703-x64
3bin/Monaco...ase.js
windows10-1703-x64
3bin/Monaco...ses.js
windows10-1703-x64
3bin/Monaco...del.js
windows10-1703-x64
3bin/Monaco...num.js
windows10-1703-x64
3bin/Monaco...tem.js
windows10-1703-x64
3bin/Monaco...ums.js
windows10-1703-x64
3bin/Monaco...nce.js
windows10-1703-x64
3bin/Monaco...del.js
windows10-1703-x64
3bin/Monaco...nal.js
windows10-1703-x64
3bin/Monaco...der.js
windows10-1703-x64
3bin/Monaco...ace.js
windows10-1703-x64
3bin/Monaco...rnl.js
windows10-1703-x64
3bin/Monaco...ons.js
windows10-1703-x64
3bin/Monaco...als.js
windows10-1703-x64
3bin/Monaco...rds.js
windows10-1703-x64
3bin/Monaco...ing.js
windows10-1703-x64
3Analysis
-
max time kernel
1199s -
max time network
1086s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02/08/2024, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
BetterFolderBrowser.dll
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
CeleryApp.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
CeleryIn.dll
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
CeleryInject.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
Costura.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
Dragablz.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
MaterialDesignColors.dll
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
MaterialDesignExtensions.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
bin/Monaco/index.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/base.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral27
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/functions-krnl.js
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral29
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/functions.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/globals.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral31
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/keywords.js
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral32
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes/libraries/Drawing.js
Resource
win10-20240404-en
windows10-1703-x64
General
-
Target
bin/Monaco/index.html
-
Size
13KB
-
MD5
8132342ce4b039603cbb3b1a32ab859b
-
SHA1
66c46050a6e5b08758c00455ae26a6c66e94ce4c
-
SHA256
3818906ed429acd27aabad7ec8771893d60658ea31b8d0c92418b96de8ee94e6
-
SHA512
44d93118187e703af1fc1627de7e97c39072e666c9086b1b4c00a7eadce1913c84dc97e8f80e2b514154ef66b23baddbfd71a2faa250735ddf4d2bc12709cef4
-
SSDEEP
192:oL3bXRggAbYm/9mv2Oxr09VpDwFgBsK7u24FzTkcmc/VT+9taAc4dReigXN:2RggAbYmbD9V9wFgBs+SFN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133670890708409982" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1888 chrome.exe 1888 chrome.exe 3092 chrome.exe 3092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1888 chrome.exe 1888 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe Token: SeShutdownPrivilege 1888 chrome.exe Token: SeCreatePagefilePrivilege 1888 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe 1888 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 4356 1888 chrome.exe 73 PID 1888 wrote to memory of 4356 1888 chrome.exe 73 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 1560 1888 chrome.exe 75 PID 1888 wrote to memory of 4636 1888 chrome.exe 76 PID 1888 wrote to memory of 4636 1888 chrome.exe 76 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77 PID 1888 wrote to memory of 396 1888 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bin\Monaco\index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff933499758,0x7ff933499768,0x7ff9334997782⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1036 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:22⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1996 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:82⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:12⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:12⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:82⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:82⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 --field-trial-handle=1840,i,9950491652656635893,12828118941682125503,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5226a4e3fe34baa6cfd98c965dbccae83
SHA1153cc1f4cd3f1494474873e3bbc224ae09d6db53
SHA256e5cb786909a82cedc3afc1b0568b30af77fb97aee8f062a6f904726a14872b99
SHA512dc4b190a317367bfdcde85fceef1280ca3a099d9f6b2aa13ee67c73ee000165d67639da02628a376e53a415b2897d3d349219b20b105e925cfb99da8ec4423ad
-
Filesize
5KB
MD538d2b16eb6bac559e95f10cce09ef419
SHA172bca5c2cca46ce164f062783d2bc567cbf2a42e
SHA256540c81d6fd0b4c0fb6f18a901446689fe23bd2fc8fb4d04688a2cbe405d0e09e
SHA51223fa9a7f98a16af619f14ef078181c3ef10873e5f0bf655dce5c887b7821c8d70c315c4b66b06bfc238f01af29d360249da5dfaad510338929706de16b4160dc
-
Filesize
5KB
MD56464bd90170295ef65a5e32e2b7311c4
SHA1019940f8798da7f2c1731f9f3596bdc96b26979d
SHA256536fe0c6f78d5b97d6f21a298ded333e71ec9d984ef13502a10187462c198c48
SHA512e0b9bdc2c0f563190cb7f4cac9086d1eaef4ce84be4decee8fcc5a83502ddcee49c222ad9c8acc36ed683a21b522cedb5e1a2e71fefbf22747a7265393c37fe6
-
Filesize
136KB
MD5ecb75199e60a952f9d7d3a05731c5a4e
SHA1dd0bc5f1c1c39bad5aa4537b309e4d7861eb60d6
SHA2561c964028df4e87568bab9119b6e82ef4e874a2dc75bc75b2a4b7a5ed414f1b04
SHA5129441b1364a2b5d75b8c5b83de48585f4adacf6f2e6a23307a272b983e82d7db45f2ec493e7b02e2185c758fbf23bb313143e17b06398676dd44ed39d27b8e904
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd