Resubmissions
31-10-2022 22:53
221031-2t11wsdhf2 925-09-2022 04:01
220925-elhg9adbc8 1015-09-2022 10:54
220915-mzjapsgeej 9Analysis
-
max time kernel
441s -
max time network
443s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 04:01
Behavioral task
behavioral1
Sample
20.zip
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
20.zip
Resource
win10v2004-20220812-en
General
-
Target
20.zip
-
Size
10.4MB
-
MD5
e17ed9853440c53954269dc2d97b4ab1
-
SHA1
ed6f99c188726247614b2affc95da967087c9fef
-
SHA256
44a6389937c8a2dcbadfb5d04829a2c36fbcc27b37ddc9719847801222d0cce5
-
SHA512
5b02ca10db4617026a911507f9d4a61c167b6435f36135cbfaa572669d53e18d33566db8643feae65ef1315be9f2744dc4fdeb44ec044d8a1770e751dac42bf5
-
SSDEEP
196608:yK6qD/i+k2V4c6gC7CASBtm2q3h7/1nUG3NL6GDsIZCE3K1zEkuwCCjnUdy13sx3:yK6m/PHqCASYd7dnUG92GDs3E32LbY2S
Malware Config
Signatures
-
Detected bankofmontreal phishing page
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ l4jb9w049j00h704k2exk46qooo.exe -
Executes dropped EXE 1 IoCs
Processes:
ChromeRecovery.exepid process 4512 ChromeRecovery.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
l4jb9w049j00h704k2exk46qooo.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion l4jb9w049j00h704k2exk46qooo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion l4jb9w049j00h704k2exk46qooo.exe -
Processes:
resource yara_rule behavioral2/memory/3892-133-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-134-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-135-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-136-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-137-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-138-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-139-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-140-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-141-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-142-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-143-0x0000000004AC0000-0x0000000006644000-memory.dmp themida behavioral2/memory/3892-144-0x0000000004AC0000-0x0000000006644000-memory.dmp themida -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 40 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exepid process 3892 l4jb9w049j00h704k2exk46qooo.exe -
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\manifest.json elevation_service.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
l4jb9w049j00h704k2exk46qooo.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FormSuggest PW Ask = "No" l4jb9w049j00h704k2exk46qooo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "No" l4jb9w049j00h704k2exk46qooo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FormSuggest Passwords = "No" l4jb9w049j00h704k2exk46qooo.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2295526160-1155304984-640977766-1000\{D950480F-E131-414B-A8E9-82412DBC252A} chrome.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 43 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exepid process 3892 l4jb9w049j00h704k2exk46qooo.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exechrome.exechrome.exechrome.exechrome.exepid process 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 2484 chrome.exe 2484 chrome.exe 2276 chrome.exe 2276 chrome.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 2336 chrome.exe 2336 chrome.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 1428 chrome.exe 1428 chrome.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
Processes:
chrome.exepid process 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exeAUDIODG.EXEdescription pid process Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3236 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3236 AUDIODG.EXE Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe Token: 33 3892 l4jb9w049j00h704k2exk46qooo.exe Token: SeIncBasePriorityPrivilege 3892 l4jb9w049j00h704k2exk46qooo.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exechrome.exepid process 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of SendNotifyMessage 27 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exechrome.exepid process 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
l4jb9w049j00h704k2exk46qooo.exepid process 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe 3892 l4jb9w049j00h704k2exk46qooo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2276 wrote to memory of 1532 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 1532 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2488 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2484 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 2484 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe PID 2276 wrote to memory of 3940 2276 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\20.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Documents\l4jb9w049j00h704k2exk46qooo.exe"C:\Users\Admin\Documents\l4jb9w049j00h704k2exk46qooo.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ff82e354f50,0x7ff82e354f60,0x7ff82e354f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5068 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5008 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4528 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5024 /prefetch:82⤵
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1048 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6004 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3944 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5012 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4996 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4888 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6008 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5056 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,27561597671420761,14769853660744923970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d4 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1856_1439483211\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={6ff9ed58-1474-4184-bfee-0cdc7b043dac} --system2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_2276_EUSVBYEDOYKZTEYQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3892-140-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-142-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-137-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-138-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-139-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-132-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB
-
memory/3892-141-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-136-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-143-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-144-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-145-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB
-
memory/3892-135-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-134-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/3892-133-0x0000000004AC0000-0x0000000006644000-memory.dmpFilesize
27.5MB
-
memory/4512-149-0x0000000000000000-mapping.dmp