Overview
overview
10Static
static
3lockbit (1).7z
windows7-x64
3lockbit (1).7z
windows10-2004-x64
129.04.exe
windows7-x64
1029.04.exe
windows10-2004-x64
10System Vol...meGuid
windows7-x64
1System Vol...meGuid
windows10-2004-x64
1System Vol...gs.dat
windows7-x64
3System Vol...gs.dat
windows10-2004-x64
3Vacuum_Nan...ockbit
windows7-x64
3Vacuum_Nan...ockbit
windows10-2004-x64
3snap.78N1B...153.gz
windows7-x64
1snap.78N1B...153.gz
windows10-2004-x64
1snap.78N1B...53.tar
windows7-x64
1snap.78N1B...53.tar
windows10-2004-x64
1compass/version
windows7-x64
1compass/version
windows10-2004-x64
1compass/vrmf
windows7-x64
1compass/vrmf
windows10-2004-x64
1data/vpd_cluster
windows7-x64
1data/vpd_cluster
windows10-2004-x64
1dumps/78N1BA9-1.trc
windows7-x64
3dumps/78N1BA9-1.trc
windows10-2004-x64
3dumps/78N1...rc.old
windows7-x64
3dumps/78N1...rc.old
windows10-2004-x64
3dumps/78N1BA9-2.trc
windows7-x64
3dumps/78N1BA9-2.trc
windows10-2004-x64
3dumps/78N1...rc.old
windows7-x64
3dumps/78N1...rc.old
windows10-2004-x64
3dumps/acpo...-1.trc
windows7-x64
3dumps/acpo...-1.trc
windows10-2004-x64
3dumps/acpo...rc.old
windows7-x64
3dumps/acpo...rc.old
windows10-2004-x64
3Analysis
- max time kernel
113s - max time network
153s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
02/12/2024, 21:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
lockbit (1).7z
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
lockbit (1).7z
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
29.04.exe
Resource
win7-20240903-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral4
Sample
29.04.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
System Volume Information/IndexerVolumeGuid
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
System Volume Information/IndexerVolumeGuid
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
System Volume Information/WPSettings.dat
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Vacuum_Nanostructuring_Marton.doc.lockbit
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
Vacuum_Nanostructuring_Marton.doc.lockbit
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
snap.78N1BA9-1.200421.144153.gz
Resource
win7-20241023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
snap.78N1BA9-1.200421.144153.gz
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
snap.78N1BA9-1.200421.144153.tar
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
snap.78N1BA9-1.200421.144153.tar
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
compass/version
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
compass/version
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
compass/vrmf
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
compass/vrmf
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
data/vpd_cluster
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
data/vpd_cluster
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
dumps/78N1BA9-1.trc
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
dumps/78N1BA9-1.trc
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
dumps/78N1BA9-1.trc.old
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
dumps/78N1BA9-1.trc.old
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
dumps/78N1BA9-2.trc
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
dumps/78N1BA9-2.trc
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
dumps/78N1BA9-2.trc.old
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
dumps/78N1BA9-2.trc.old
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
dumps/acpower.78N1BA9-1.trc
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
dumps/acpower.78N1BA9-1.trc
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
dumps/acpower.78N1BA9-1.trc.old
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral32
Sample
dumps/acpower.78N1BA9-1.trc.old
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target lockbit (1).7z
- Size 8.8MB
- Sample241202-zz2hhasqev
- SHA256 9f3a43ab58c24e5394021009092be2d3ecff413aa57a440542e3b2a827fd9b54
- MD5 a1beeabd1bccb8266631e4cce53eea26
- SHA1 917975f62cda9bac4badbb09d4f5e99936e5c30e
- SHA512 b6fe92909419e8eddd1eb3139c11ee968f6b6cd1b95073fde356faa707e46ffec42a819c732016175bcc4aac8da187fd75cea7b857fc1e693c6ff8a86aa1815a
- SSDEEP 98304:ciMFZDHZg7++Bfe65+PdBMgV3c2Xi5DyVZD93tNmD/+IV78ZtUV+kIpOjs7D6c6Z:ciIZD2S+BfD5hEtyVGUEOA/+kU5pXn
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2940 chrome.exe 2940 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 7zFM.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2524 7zFM.exe Token: 35 2524 7zFM.exe Token: SeSecurityPrivilege 2524 7zFM.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe - Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 2524 7zFM.exe 2524 7zFM.exe 2524 7zFM.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2248 2940 chrome.exe 32 PID 2940 wrote to memory of 2248 2940 chrome.exe 32 PID 2940 wrote to memory of 2248 2940 chrome.exe 32 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 1728 2940 chrome.exe 34 PID 2940 wrote to memory of 2728 2940 chrome.exe 35 PID 2940 wrote to memory of 2728 2940 chrome.exe 35 PID 2940 wrote to memory of 2728 2940 chrome.exe 35 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36 PID 2940 wrote to memory of 2168 2940 chrome.exe 36
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\lockbit (1).7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2524
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ed9758,0x7fef6ed9768,0x7fef6ed97782⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:22⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:82⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:22⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1396 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:82⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3848 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2476 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:82⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2680 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2696 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2708 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3892 --field-trial-handle=1360,i,16105514496023461191,13810812711163883736,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
- Size 215KB
- SHA256 1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
- MD5 2be38925751dc3580e84c3af3a87f98d
- SHA1 8a390d24e6588bef5da1d3db713784c11ca58921
- SHA512 1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
- SSDEEP 6144:np39th0dW8TvSqV4c7SqsxwLCk591Y7Zmb:n/B0V4cRsxbkpYlmb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
- Size 16B
- SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
- MD5 aefd77f47fb84fae5ea194496b44c67a
- SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
- SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 853B
- SHA256 ed9d17a6bccea15f961de6d453c169b02ab2d174e0c616e39547aa74fad5b484
- MD5 1a8e85535322bd2d83e5edca0539296a
- SHA1 9b9f74d4831126cd3424c9d8a0443266d6dea803
- SHA512 1b0bd726e11eb7d9ccb492ba121922f34b370fe72d36ec8bdd64d6f787f9cf4309d77f604212339ef27de6fb15ce3f3bcd49c7b2eb8ac31e79fe6a420a52611c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 853B
- SHA256 cbf27a1ae209541f68ad12d8b904f8d074990cf5c135ef9909ab9d5388ff3798
- MD5 97b4f5597c2796eb3627dc91643c9a3d
- SHA1 faf7959c8542d7230e370449e1910098e321058f
- SHA512 1da864201d891a5c65e77a81a4e7232c6516b9556192203976064140a35f4c7fa889dbfc22b68d82e5210c325c8dd1fb6a530d5247e5080adbf29a06ec39fc86
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 690B
- SHA256 3dd8b00b880102210685701b05d901f01acfe066b5f52d359181db1daa7dbe10
- MD5 7ca39792005936f54f1ef383e13acc3d
- SHA1 7e0c1721b6f5f82fcab788665ea49b2c70566832
- SHA512 43d107300cbf6ebdfacaed833ca88b86efcc66f8984c2844c8b77af5a47fb893191c5bea52f0e9301233e6ba15bd939f88b3c7ba142637976b1fedbbef909f50
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 97ab39ee683a1df3f8982df6b0f7965ad388bde85723c233e632112c0e8cd851
- MD5 d09ed3ca9adefcf32f9982eac58c258f
- SHA1 c493c37fc92df9a167a96248f8990a012acbb0f6
- SHA512 0fc4de1ef1e80e56711065b09d2b1e60c800fd44995554216cd35afc8b703b802ede9e471e244cfc0feb6db8dd527b6740fd7ad840081a4e7b0824d4352f7028
- SSDEEP 96:w3C+4S8cKI7tFd8iZRy7Di+6MsmdeX8ke1tqOFRHQYN8kjVhYtjEsXt0/cg2Vup:uCc3/8syy+FHke1otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 4ca0aec1479881fb585d2c99821a046b7a1714b7cb9f9dfc2f8a5a2edca1924a
- MD5 ee6465034acc56be45e5c5b304f63b54
- SHA1 c46400ae98d3cb7a9cdb9424580400edf193afa3
- SHA512 5543d8c1b02d911c2b0453a85730e9c8261da410cfa88f125eb278b63865ca87cea78a177536e8513a5f70f1511214d47525e6ce916b8c0240458f59a49600f4
- SSDEEP 96:wo+C+4S8cKI7tad8iZRy7Di+6MkDRgmdeX8ke1E5kV1tPmOFRHQYN8kjVhYtjEsg:0Cc388syy+FWRke2kV5otjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 eb535fa9c3b7538c4ef4c099bbe7e9831041fb2727037baa2d6b1b2acfb1cc3f
- MD5 0e003aecb95c74d13e02413a126e0e76
- SHA1 f717112f4b673c7811561bbbf325855a9a3c0e44
- SHA512 494beba853632d850b452f791f48c0d209d75efab7c9c85813148b8274bf5cc2d3ccc4d561adf78a82fc505d157702f43a91148707663ab320a9c6b0d74937ae
- SSDEEP 96:wo+C+4S8cKI7tad8iZRy7Di+6MkDRgmdeX8ke1EWknIMH2h9OFRHQYN8kjVhYtjU:0Cc388syy+FWRkeZknIootjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 b1f6cd6d2bbf76ff5fad51a96ef414ec5331afdd571ca0d5247fdb91921f35f5
- MD5 26c58759383645580e5a92e0a1219f40
- SHA1 adc7f00037983af9987175f64a0ac26aac683432
- SHA512 4c3a40736cf2a60c7f203d2961330f259bd66f9fff097183b08d58f69846ecc4c06a9f6d0c5eed2764a92df8f3f6ede5e31e21310ef71bad1c1d90918dbc13a3
- SSDEEP 96:w3C+4S8cKI7tFd8iZRy7Di+6MsmdeuIOFRHQYN8kjVhYtjEsXt0/cg2Vup:uCc3/8syy+FjLotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 347KB
- SHA256 49e09d5f07d996c3c9f928c8b10f04abe644d3386fc58859d422b82788c083aa
- MD5 f61f970f9179f59f65dc1c18702ee9dc
- SHA1 e424af5ec151a392577248c39ccf95abe3c77091
- SHA512 11741576dd475f0d70869073e0bc935bc1920e7553ee4494eabe74dd114e5fc0a68a24c67e2bf77a9da338541aa9f0e6e1779119eb53b5748d69119342791a32
- SSDEEP 6144:W9qC+/LI+5NMRROiCq7xGHltv62YWTMsG/487E8SCKl0tACA:o+hi1oHlRxhT9G/p7E84GtACA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab937B.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar939D.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP