Analysis
- max time kernel
149s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
02/07/2025, 04:29
Behavioral task
behavioral1
Sample
rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe
Resource
win11-20250619-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe
- Size 2.3MB
- Sample250702-e4qlksssey
- SHA256 98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594
- MD5 2bae3892bffd8eb338529e9a90de769a
- SHA1 651decf434fc8c2de6cefa0694048031a0fc57d2
- SHA512 077d157e790a19de039218917dd5f01b914bafeae16848dc336fec027e48bfaefd249369c488278dfeb7edf44ddb5750fdbda466c382f0351abb970c6574d339
- SSDEEP 49152:FlPhFMm+jN23QLOKefTnsOqfh9tN63hjviq9zoY0FiT5jaQ/6u+YGU9q:XuGY/w
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Deerstealer family
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral1/memory/3408-87-0x00007FF752FF0000-0x00007FF7532DF000-memory.dmp family_donutloader - DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Detects DeerStealer 2 IoCs
resource yara_rule behavioral1/memory/3408-0-0x00007FF752FF0000-0x00007FF7532DF000-memory.dmp family_deerstealer behavioral1/memory/3408-87-0x00007FF752FF0000-0x00007FF7532DF000-memory.dmp family_deerstealer - Downloads MZ/PE file 1 IoCs
flow pid Process 9 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133959042054882133" chrome.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 4820 chrome.exe 4820 chrome.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 4820 chrome.exe 4820 chrome.exe 1072 chrome.exe 1072 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe Token: SeShutdownPrivilege 4820 chrome.exe Token: SeCreatePagefilePrivilege 4820 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe 4820 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4820 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 90 PID 3408 wrote to memory of 4820 3408 rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe 90 PID 4820 wrote to memory of 232 4820 chrome.exe 91 PID 4820 wrote to memory of 232 4820 chrome.exe 91 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2552 4820 chrome.exe 92 PID 4820 wrote to memory of 2224 4820 chrome.exe 93 PID 4820 wrote to memory of 2224 4820 chrome.exe 93 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94 PID 4820 wrote to memory of 2296 4820 chrome.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe"C:\Users\Admin\AppData\Local\Temp\rl_98df906d9b4b3caaf8bf153ca197f209cf1d746313fb33abd2f6855842874594.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffb24adcf8,0x7fffb24add04,0x7fffb24add103⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2028,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2024 /prefetch:23⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1556,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2248 /prefetch:33⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2372 /prefetch:83⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3204 /prefetch:13⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3432 /prefetch:13⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4360,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4376 /prefetch:23⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4704,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4696 /prefetch:13⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4828,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4304 /prefetch:83⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4960,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4972 /prefetch:83⤵PID:624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5356 /prefetch:83⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5592,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5604 /prefetch:83⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5552 /prefetch:83⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5628,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5740 /prefetch:83⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5724,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5644 /prefetch:83⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5824,i,16609933787658999584,2219350036721303749,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4504 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:1948
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 bd92506f8bc39bd51107514355abec65f3d9104af4a3f78bcefb29bc4fcf08b7
- MD5 43c994d94340aabfefb01ea0d3f76682
- SHA1 faafb0d53afc825513441d73f21f2d9925b1e6e3
- SHA512 f50cd8cc2c6e9fb117f9e00eb377d2385eff14261a36523653fb330129228627b95062845b80ea021764672b3fb3757f40b5aeee124002c8bc3451ada992d890
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 61b4f7b2a70b02d0b59bb2d58b941e7953fc94e7410638face10fff914f75aa5
- MD5 48aa80d25b47d80de4208db566f43803
- SHA1 c11546828e79ca9d779dad408d4c11822fa7d6be
- SHA512 e3e8b7baa2fa1a37accf15b2cf548369f6f5b9667ef7e350071f51b9fe506ff4bc50a626a8c6afa9d0be6f425fb8d7aa21cf6cc6041baa2f2eaf9651e9328d0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 10KB
- SHA256 5a68562e7c0ecfe812755e6c46edd6fd4da653a2d8bec950a0ae9530c47ee945
- MD5 50fee9fe0f2339a0f56816b1683834e7
- SHA1 b82a7dcd84f2b3cc28dc1f14fd4012e577be5cdd
- SHA512 f08d07d0d6aac34c236f654933a8921453e0074987303a727672b6464f1c812b2d1d665834971986dbb4b9ef21cdf6a240fb1df9d200cb543e37138e8fc9045c
- SSDEEP 192:wYRwDwG/aZ8PRpAjHS+WNkVoxT7eQ+2N0ZOipQyIsnA/g4:wYRwcGLXALcqoxp+2i88Z4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 8771f8a67e22ec31c7d201b071fa892bf6bf4f375d883c2570ae216505ece82d
- MD5 084cf1c20c65ce625086b9c60580047a
- SHA1 a0cb78e5b160572168795b17e5de1ff90e61f6c6
- SHA512 e85a15c69699a3a239a77e00693d36ccab4357da2734237858cda670d3a8ca32c22c80216966dff488aaef8809fe996f5ba48de1a2c578c11a71872cc3f59a6b
- SSDEEP 384:a+2c7pLuLceii3XAxPkXqKf/pUZNCgVLH2Hf1m/rUZtHG+1acsKB:aNc7pLuL77HAxPkXqKf/pUZNCgVLH2Hj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 20880bcafeaf0c05c07be8a2080bb8565d8df40b1e511902ab7781a3d32df646
- MD5 3664386b640d148c3024a42165e025f0
- SHA1 608a0b4c1e0f135cec725e58ea33ff8174ddf7e1
- SHA512 bc1396454dc92ce7ca83041a95bb0a50e7f87c7089e3d3fa7d1a2e2fc01725665852fd85960460bcae95c08f453a055528308778f52ee78c1068530b2550f618
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fb19.TMP
- Size 48B
- SHA256 73bc50de4fe781b9bb5d258ebe85631924585e44ca821a2d3f18da5e3d8e125f
- MD5 59fd469b8ce41e1d7af46abfdc53801e
- SHA1 091edbe6534a15833399106958be832fbe67f57f
- SHA512 ab28ac0d680beb88ece05f42d84a1e161c47d7fb29ab46824f906553354a4659cbeaf022fc7c8c5eff12da4882b09b9d8cd149a377290467cd83d69350050174
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
- Size 13B
- SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
- MD5 a4710a30ca124ef24daf2c2462a1da92
- SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
- SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 164KB
- SHA256 2b8d5cf479fb5e24f5de9e1b25ae140b034dffac7a39e09f8887ec781fbd8197
- MD5 7e8a1c1d7c64cc0425e2b102f6f331bc
- SHA1 b940c13fed953f2d9a48b3cc186b04b48606e9f0
- SHA512 8193387c7996fd2428bdf5ca6f21a4700283b3a0e769ea6c8e52f2fae57082eb0b608689d2a461ff3d4d1674aec68582e0357fe2f42b458e0ccc1305b2f55968
- SSDEEP 3072:TnlqEt4LBZtJdQUlSqXjM4rTmN5eWvStRNoV8cWK7XF+TwMn:iZp1lNJrTnGfzF+TwMn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 83KB
- SHA256 cc2e80da3b123df92b11d7a86c168fc03885a548adcfdde219547d39d31303ae
- MD5 89ce336100caac9ecc6c8b1650d4a2cc
- SHA1 6290414a55c4289bffe5052d1f101456a0ce95de
- SHA512 c215b9baee9bbc36c817fa79db963fbce2db348d9302658fc9f3f55aa2736359142d71a03fa055711e81cd07cd125479a6bc27cd76adf273191ab7d7d64cd9ef
- SSDEEP 1536:NEXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMw:CXjM4rTmN5eWvStRNoV8cWK7XF+TwMw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 164KB
- SHA256 e9ec29bf137456751476e58eceb786dfd8c12e26710551ac5bfc5296550f5ce8
- MD5 98c89fa40a644399940b233070758e64
- SHA1 88daca9466a43ed224becb912252ae7eeaf12cd2
- SHA512 f4e92604a920ef56f1dc9916ec87ca95bacb4800684f8897156427ccfbbe69f22842e044a67cb8ce1afdf769ac1852f485a0a70f1c566a6e850a046e96932bb2
- SSDEEP 3072:SnlqEt4LBZtJdQUlSqXjM4rTmN5eWvStRNoV8cWK7XF+TwMn:HZp1lNJrTnGfzF+TwMn
- MD5 SHA1 SHA512 SSDEEP