Overview
overview
10Static
static
10FlexerApp/...ws.exe
windows7-x64
1FlexerApp/...ws.exe
windows10-2004-x64
1FlexerApp/...ws.exe
windows7-x64
1FlexerApp/...ws.exe
windows10-2004-x64
7FlexerApp/...pet.js
windows7-x64
3FlexerApp/...pet.js
windows10-2004-x64
3FlexerApp/Flexery.dll
windows7-x64
1FlexerApp/Flexery.dll
windows10-2004-x64
1FlexerApp/...I2.dll
windows7-x64
1FlexerApp/...I2.dll
windows10-2004-x64
1FlexerApp/...re.dll
windows7-x64
1FlexerApp/...re.dll
windows10-2004-x64
1FlexerApp/...ms.dll
windows7-x64
1FlexerApp/...ms.dll
windows10-2004-x64
1FlexerApp/...pf.dll
windows7-x64
1FlexerApp/...pf.dll
windows10-2004-x64
1FlexerApp/...sample
ubuntu-18.04-amd64
1FlexerApp/...sample
debian-9-armhf
1FlexerApp/...sample
debian-9-mips
1FlexerApp/...sample
debian-9-mipsel
1FlexerApp/...sample
ubuntu-18.04-amd64
3FlexerApp/...sample
debian-9-armhf
3FlexerApp/...sample
debian-9-mips
3FlexerApp/...sample
debian-9-mipsel
3FlexerApp/...sample
ubuntu-18.04-amd64
1FlexerApp/...sample
debian-9-armhf
1FlexerApp/...sample
debian-9-mips
1FlexerApp/...sample
debian-9-mipsel
1FlexerApp/...sample
ubuntu-18.04-amd64
1FlexerApp/...sample
debian-9-armhf
1FlexerApp/...sample
debian-9-mips
1FlexerApp/...sample
debian-9-mipsel
1Analysis
-
max time kernel
40s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 15:44
Behavioral task
behavioral1
Sample
FlexerApp/Flexer_Windows.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
FlexerApp/Flexer_Windows.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
FlexerApp/Flexer_Windows.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
FlexerApp/Flexer_Windows.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
FlexerApp/Flexer_Windows.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.54/adblock_snippet.js
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
FlexerApp/Flexer_Windows.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.54/adblock_snippet.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
FlexerApp/Flexery.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
FlexerApp/Flexery.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
FlexerApp/Guna.UI2.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
FlexerApp/Guna.UI2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
FlexerApp/Microsoft.Web.WebView2.Core.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
FlexerApp/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
FlexerApp/Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
FlexerApp/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
FlexerApp/Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
FlexerApp/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
FlexerApp/Monaco/.git/hooks/applypatch-msg.sample
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral18
Sample
FlexerApp/Monaco/.git/hooks/applypatch-msg.sample
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral19
Sample
FlexerApp/Monaco/.git/hooks/applypatch-msg.sample
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral20
Sample
FlexerApp/Monaco/.git/hooks/applypatch-msg.sample
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral21
Sample
FlexerApp/Monaco/.git/hooks/commit-msg.sample
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral22
Sample
FlexerApp/Monaco/.git/hooks/commit-msg.sample
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral23
Sample
FlexerApp/Monaco/.git/hooks/commit-msg.sample
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral24
Sample
FlexerApp/Monaco/.git/hooks/commit-msg.sample
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral25
Sample
FlexerApp/Monaco/.git/hooks/fsmonitor-watchman.sample
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral26
Sample
FlexerApp/Monaco/.git/hooks/fsmonitor-watchman.sample
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral27
Sample
FlexerApp/Monaco/.git/hooks/fsmonitor-watchman.sample
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral28
Sample
FlexerApp/Monaco/.git/hooks/fsmonitor-watchman.sample
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral29
Sample
FlexerApp/Monaco/.git/hooks/post-update.sample
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral30
Sample
FlexerApp/Monaco/.git/hooks/post-update.sample
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral31
Sample
FlexerApp/Monaco/.git/hooks/post-update.sample
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral32
Sample
FlexerApp/Monaco/.git/hooks/post-update.sample
Resource
debian9-mipsel-20240418-en
General
-
Target
FlexerApp/Flexer_Windows.exe
-
Size
292KB
-
MD5
f9895e5aa823591bdb2abd602711e01f
-
SHA1
6c7cc1e9b8865e00dbeb2f3ec7134d3936541229
-
SHA256
61ba333eae9bb5354009320ab96eb3dbf638e2013e3eb1fcd3262d26a43c52dd
-
SHA512
c2e1ef025022a245501cb4d6970406b2d22e3acecb716d1636190e95d858be7d6b912c0d79589d1abafa99d41cc84669a570f1fda4106fc9d98a0303b164624b
-
SSDEEP
6144:cFyI+ssfUkxkHMDknkJoU9ISmsGkcnjmaORgOqwk8E/YHImjv4wey2wotuhtw:cFybhKsDVoUqFsGkcnZKgOqwZhHImjvC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2016 chrome.exe 2016 chrome.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe Token: SeShutdownPrivilege 2016 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2016 wrote to memory of 2580 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2580 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2580 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2644 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2480 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2480 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2480 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe PID 2016 wrote to memory of 2908 2016 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FlexerApp\Flexer_Windows.exe"C:\Users\Admin\AppData\Local\Temp\FlexerApp\Flexer_Windows.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7639758,0x7fef7639768,0x7fef76397782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2844 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3112 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1416 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 --field-trial-handle=1320,i,545690260281672185,10693599008153429457,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmpFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD537991ccba6087290210139c968591abb
SHA187da4dda95fc70706725ff1a0ea293b08a751d8e
SHA25683195a1e8f27c6a1c1054a86e92142d81c891a4b22762b369b0a3a68c77bf1e2
SHA512f1649352e8600c47178c7ad1810e74f2ecdf1f7a009896c25b79b820c010b5363d11774129e58be4952c1bf7bcf24615cbfe2d57d1871558c2bb98968e6e49ef
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD50f7e39c8cf1c77118f3a35daea3b8096
SHA1792c97fb8c44300c78ff3b8092a808ef1327186f
SHA25649eef76b949e3194dcf002cfbdc41d5e62d2abd64ebe4c65b5a52740adf68544
SHA512ac77d39b8b897ba3e0a2b982c4ab1c298774f84e075fde2d05e6abd8cd9442a1af3dc3f19992a83cd6c5e27eef19b28480a165d21c121c70aa6297c9e5bb4119
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
140KB
MD541a30a5f972157118e694ebe06bf7196
SHA13abbb48689246428d9fcc16bf450997ee6be22a5
SHA256ffa6918f0dc9e9b8e3e604d51d5d7763b452f27796bfa688501e6769f3dfa1ad
SHA5129bafdfa32fd413675687c54233d1b142b98602b0576d677ab9f33173c2bc853b370728cdb2de88dee0a30b50df121dbf1ced387c51aa9b48e04af32d1611c38b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c53c11b5-d050-48f4-a909-c372a6e7ce8a.tmpFilesize
295KB
MD58f59c0991a6372526095ec24c427c264
SHA1cb4fc0f900726214855e4a65b03d7eb7f0db0c77
SHA256c3ff36d07123d5738f82da29c2b80857ad5a69aad0e05776f7dc9baa609cc012
SHA512bda5e4817b395ce71be12622ed0037eb99b62ba4f1953850fdd1e7f25083a8b6077577a2b40fbdf86fef257558145a4f579830b3a8eac8d93b2555887a4e0b74
-
\??\pipe\crashpad_2016_UGIIUGCJTZGCJHVXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e