Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
210s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2023, 21:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://n12531z46l42.static.ctmip.net
Resource
win10v2004-20230915-en
General
-
Target
http://n12531z46l42.static.ctmip.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133399795216155835" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3500 chrome.exe 3500 chrome.exe 4344 chrome.exe 4344 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
pid Process 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe Token: SeShutdownPrivilege 3500 chrome.exe Token: SeCreatePagefilePrivilege 3500 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe 3500 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3500 wrote to memory of 4988 3500 chrome.exe 69 PID 3500 wrote to memory of 4988 3500 chrome.exe 69 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 876 3500 chrome.exe 88 PID 3500 wrote to memory of 4312 3500 chrome.exe 87 PID 3500 wrote to memory of 4312 3500 chrome.exe 87 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90 PID 3500 wrote to memory of 4660 3500 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://n12531z46l42.static.ctmip.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdcc69758,0x7ffbdcc69768,0x7ffbdcc697782⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:4312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:22⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4596 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3260 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4736 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3120 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5624 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5804 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5956 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5420 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5336 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5424 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6020 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5108 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4572 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5592 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5856 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4956 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5892 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5824 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=824 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5716 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4868 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=1956 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5684 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6848 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7008 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1592 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6260 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6928 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6252 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7016 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:12⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3828 --field-trial-handle=1952,i,6976608362596198327,17848941883089485672,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5ca6e0dcaf6fe11e3b4d4d299ecbab7a6
SHA1a637b13aff3baacc733eb221226c36b71a3d3a7b
SHA256f4a93cf3834c5f3bbbab2ba619425fb1415050a847f5bc12cd6b0bab5e68074e
SHA512fa037f9ac77644d641bb6cd1b18722be3cd7d039738f8770d6a09cf7e5829b1602a772ab643ce8cd683a0d11e62c5ccabbd555fff25f77c39034793510543ed9
-
Filesize
55KB
MD5ff7ce0de44e974178c8338e6ff298252
SHA131238cfe541493b6521d88e8fcc2fb174d2eb331
SHA256ddd1ed2b462b40e1d3b67e5c17a7c9ff5c7efc54de32c69b59a6a44057fd20ed
SHA5128bd68b678d718bc87e11d850bf778c7a1b001dfe60c078876228812782d0befdc72fb28845e5f103d6859120c0fbbc853e3f32b13bc59b1e6a61799c7941e947
-
Filesize
40KB
MD57af63db34db605d8dd2c1c9a01b1e053
SHA10a78f5165c37eb51371afe2e9dde9ea1f70b8912
SHA256b4f04e6c5f7e27398f72dceeb47a4711f6b4d475c4a2c8c23e8930d6718ce938
SHA51278387a5038d814c1ac71a35bb44e0e1e9a49456e4b0da8e38766f3ca3f4ce9f973926697701bb1cfc47552dc11ccbb1326488e0a28f1b1f0cd96e60ace05a8b5
-
Filesize
384B
MD51231cef0676fac953ae07cc68b9c9746
SHA19f79281a4ab416d2638a786b8ec4dcfd25fb8689
SHA256c603317f44d36e24b91b749b9f8fbc90151e3ae77517b45aed5b035fad8ff29b
SHA512dbdcccc8ea8a5d0101f384744bc15093d3ceb6f90b202f28c2d2dadf1649e32c508bd43c645d4d367268dabb83c2eb5ad0a652a0dd830ecf903b318ddcedbe86
-
Filesize
120B
MD5a42ece854a58599d92b11b55af54546a
SHA169147dca4160ac2528a1a96ce29b87c0acdb975d
SHA2561ed2124b4978499a719f5325cfe32f76088212abdd8685572599fc0c46aa200d
SHA512b8ed14c2b57b73eb036f6f70dc1405ddc3d4a7dbbe7aeb51f9c35409e72f29c42cea2b3f7294aa1e274d9c39fc3d6c70868244598889fe035bb1d8b22edbe99b
-
Filesize
96B
MD50417db1fd72891be4020a35cff60b575
SHA15fa4bb5e38611a08a0dfc036879d87edf8b26195
SHA2562e0a187257240a2c045b4ae73a909168c6e82d71fa916138062a5570d3bbcc25
SHA51263d743c13bbc2f5e7945dd118816eae381c2371bfd7f8cb0760066b917fd395aa27ccd023058a696ba07e9c0ab70f3c95deeac643b4995c3fbfde9c08f0b3b6e
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD52de7b3053f3ac5d95f1805ff415aadd3
SHA19b3384c443e2e044acda7822cf0444614b229e83
SHA256e2da4aac4c90474b0a44600fce8abd62f700a4cf13f8d692bdf5ff464cf146df
SHA512668c00a6c61def2121654be8ef8569dc394877d92877aabc213ad474aee741d59e10b95fd63b6f40c1f3ec74fcebe97adcf5905810608ad2e6011b30851f0c84
-
Filesize
4KB
MD5ef5220c144a01dee9575d50a67c8b21b
SHA11ff04325aa4302b29ab476cfe5cb2aab7ba0b1c7
SHA256e2a3833125d0065852cc98e2035bd2b01c0ec39ec2104030caa13d6c32a66bd5
SHA5120018d868fb0ce6db40a4dbeae3d4f37765a76cec9ae72eeb0aca666e26a259ab078a008f51be643187791275184598e1d8994d21d8871b9f15cea2ae87ac3c0f
-
Filesize
4KB
MD5748cee698034ebe7e0c3f7426f90a18e
SHA11d3c1117ff725a92d30149489f15f25a19a64a1e
SHA256544c8e83fe5357127c54cd695d92840eef38156beb0abf3885416446f34bc11c
SHA51274c1efee92656882211ae7ba33ca6389ae377cb5fab3e5b3aa0539a4e942ed743194bf967118d6e286b886a163cdbf058b728208dac77934e521479ac0e6af9b
-
Filesize
1KB
MD5c71c3c5d2c16e8cbdd42940a1d592b83
SHA144f1a5250ee39fcaad254868e60ac3edbc8ff145
SHA256b686d1cf28ad1d02ae6528bca93029e7d9f7f9d84f707c14821a16fb9e4f1f26
SHA51262ac01aaf1675c046f398261e7edfae450d75b55862c56b5ea085cbcdaa8fbdb4bb501b3181eddfb03c63add6287388c9a43f2422f6ca44463a1047fc8f59d24
-
Filesize
1KB
MD5bc8aa7ccd895dffe63331dc3433bbb29
SHA1f549aba8f40abebc62deb159fd53cd2b07e79d29
SHA25664ecd45b17f61eff9f90699c463be8525205371f960f15d58a8ac4d995250729
SHA512ccaf68bcf0c699a283882f645ec8039dfbdc5b3aa307bcdba98c31e65643fd97d0a13570c250ecbd03823cf73772af7e64c31c17c9a6d95b91dfbb1aefe8f801
-
Filesize
1KB
MD55b513b051b591dc8c44c549e132f1e15
SHA182eadb5c8020a5adb24d006fd9f36c616b2999fd
SHA2564101cfeb2dab441f2ba06242c4e3c114bca44c0ea3a0bb5ba154b4ac2c4e5329
SHA5123611762fa7f8f9c04718ba11a3e5d11f78a20b9d7b0c78440009708a1a62fda98c4e13f0514f1e777c7b5bf4c9d9a7bd5d01478be8f6997964fc77ae448d4145
-
Filesize
1KB
MD572c5ffbfeefdda33ca14f540d17b524b
SHA1e1bf5b9ef1b3329f3d1172bac792d7b966b26296
SHA25628f438b98bc3cb3b6efdd8ee5c0b144d6cd9dcb7bb7dce22c48efe31bfe1829f
SHA5125f34f8d547c987b82973a0893353b3f3d5492efb12d001359f475393be9d0f542a46e982ab7fdac73aff784e723c153429f95ab6b7b42ed594fec333350dd1db
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
7KB
MD5d74710aaa284378d363cf74aa907cad0
SHA16e1352fa0c2875bed7d835e7c990f723cb72ebb8
SHA256ce615b59624c8040f4792d5f51ce1378b1d3971bcbc4c1efd76be613519977dc
SHA512a338467eaf6e68bfc2600062bf74d817467d7595be08414a89d1a7786b81c60d396115a5459817119ace89142ae61b8ac8a1cb12d7d488a4930ba44df390e76a
-
Filesize
7KB
MD5d9720febdc56fadd62eb820a15874e4d
SHA191c728929c9d2cf57727f3fa53ea065ec12d4882
SHA25628aacb3e2e3eb89be3239b4b05d2c5792ed558e63e8c8ae2759e59fcde3d614d
SHA51231d65b39e0493ae5c654c63c8b3f954dabdb0e2805ac7376e8e73c9f5b1361a1f7e02376c73883a22db568ef377de6cb8d73787776c575c0f3ab9ff7796c1560
-
Filesize
8KB
MD55bb6a580f72cce1d9ad59ede6a70fec4
SHA197c2b860f22375cea7d1c16d1c177f705631f495
SHA256ea816bfd4200e025f102a36e0b0bc260c9c690c941b07814e29494cd17303b50
SHA5123fa84cc13ad27b2bbeda66ec2463bd5bac7e25999edc0d70d10cd3eecd3983eb9048ca28b7890be157c4564e0a3a5e203a172f519f62c84c144f9fac38b6e873
-
Filesize
7KB
MD5adf60a4989785e1245b42bc866363d34
SHA1a3eb7bb04923ff1e7b89606a526e33539d25c4f4
SHA256394b57e0370a53eec6d8149d10c37d84f462689b374f398d301e829d4e43bc97
SHA51294046b2e789063dd877cc9c8db8b28c57a1f52818c42970c1073a10f8c16b0c73c9319b5cd2833548f196c566fa87066b1794cb13dc908a105891acf1e2232d1
-
Filesize
7KB
MD5ab4f04d9d692d4eb28c3ba1f2b299400
SHA1ace2703558b8d302c0b1ddcac8f8cf2c0a697b37
SHA256ee77566efa0b336cb2c3c48e9da9c08b2f4c945002219194ef38e43f1231e553
SHA512041225a38782af0104104cf2666428be4928c309e4be4e71b60ae6aa6b72deda5fc90aa6944e9780cd42f1f69ab8e32c49a204ded437b1cb7d568ea8b16291c7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a150743ebd854d31c077e7575682c26ee20fb883\ee9fa443-b047-4e70-9774-14f394516c65\index-dir\the-real-index
Filesize72B
MD540d5af558f6f61ae2ae473af7b4c282d
SHA1b36e2ffc5908bfe69be9c190b246cde782b61d18
SHA256dc101f657a5bc3fd2ee88a44ea9dd9f678337c6022a9d1da93cf3982788c915f
SHA512c0f1eaa4abc69f055985cd680d110e57feb97c6c234af26dea410d2952675c30f0b4b87411f91323bd4131d8634f534219b9d5f4affc84ac67672d76a677c79d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a150743ebd854d31c077e7575682c26ee20fb883\ee9fa443-b047-4e70-9774-14f394516c65\index-dir\the-real-index~RFe58d491.TMP
Filesize48B
MD5fa653170d556d369236e0d67fc95b745
SHA1bde80ce93549c64eeae2c7807b63c7c261b021e0
SHA25626a09a50649607aef01fd0bd5b71264808e3c8155b6f913f1e799a21440069ea
SHA512c04a07162ee194411474afe8e0f7b5a87e5d4a6decf28ad1a6bc8f4ac07928daf286523d2a9cdd08ec95d8898999ffef5558172f0bccbe419797a4c5e2803616
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a150743ebd854d31c077e7575682c26ee20fb883\index.txt
Filesize112B
MD5c3b6e81b36b407c634249fe75b0abc46
SHA143a592dc76deda5d2e6ebcccbd5528cc2f073004
SHA25651cd6dffb03ca1bb1b5aec7496a619f5a4a487e53e9d984be046c9a46c32f512
SHA512d2c65397772e78838494fe6c1a914613d6cabcb4887370c73a7663a860a68d0394b8f4ca7e9e8bbfaa7efe274fc9270c9937f2f345f4545f865633a83c00c29b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a150743ebd854d31c077e7575682c26ee20fb883\index.txt~RFe58d4cf.TMP
Filesize118B
MD53de015e925538e4f146bc1f5c28b574c
SHA18fdd2eaf76d56fbb1924d35f02fd8d621c6068c2
SHA256e09dc482014eb10a9f0c61b5e81d9aa16ead11c9bf1053613db76df19e81805e
SHA5122464724c0146a4f601e5710dc3f033f4f36c0cdd2bf88eb2e1184b79aca0c4c3d2f591ac1552e607e4363d614e124aebcd9be35e715c0d357d366a8c89ecdd22
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5faf6f7f36429c8666be1badfcf9096c4
SHA16321febe99c108f9e7c533703eca80f6cad7d4ab
SHA25620640b7ea59e389cb5ce30f074e8f5129e2d30566cf9d2145237a4c0fb9720a1
SHA512c4c843121d19e6e0a6c26067e7eeb02539b52e427f42e553bdeab480cd2365599b32dd4ccf78b0683e76d0f98200b9a6fb3f29656f1b0c9d0ae16cbf9c32dfe6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c0c0.TMP
Filesize48B
MD5b7b218dc52ed254e975d2e233b4efb25
SHA11c6b10aff53648fd786ccdeb9d82b924a712e2fb
SHA256f251045fd03cd9ef8b605382239ecdc9ab9bb65c4b2104e17236a38c5dde6cbb
SHA512408f388b4e7e983faf934bc347b756b4c79543d83bc4f820fbfca2328b709c2a46dd71f2a85891a0aded91a52b1e0df3e0a3285f9076b73180e822f20e60f6f0
-
Filesize
101KB
MD51ab3347983825e27a45e60ded76c9d04
SHA171bbd7868e0b2f685217de5750eb36d7ebc73d84
SHA2569dcd70bce79e9426b2004850a414d63054ea3b191ab4b79d842ab1380748c6bd
SHA512b9db730bcf598c32817e9fe1745e91d86eca1405b77e8f0e885d747b2fbb8dd973b314ac6e726368e16916f6073d77269eb3709701131a2e7d357870a2b1429e
-
Filesize
101KB
MD5d71bf75b61ac53db19e66b2309acb5c4
SHA12d9cbe172eaadd0c1a281dfd02d9a16f14cfd002
SHA2565982fc4d29270f6d9472bde6af8138ce5eaecbd92dfff27fc96ee52479298d85
SHA51203209eb2ebc597423c906b05c16a4da2733f63c0e79f772ba4fd757af94ab1673080df7f0bce04c654514d99873503fd6e6ea72d9e1c49cec34a788999893c0b
-
Filesize
101KB
MD5a68de98e05946708d43461bb773bff90
SHA1ebede3b15bf824f9817f48487044efb05c633274
SHA256f2008d42df715c4930de0053f4151976f74d5716b680fe24d60f302245d617b3
SHA512c69517f12f4649bbd696c79dd0f7c4d63e37ed98f85b63015e9351d87958ffc93759fa8d37800b36ac2f1c4e38c1083cc265261f0cf4b358abca17cbd50d00f7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd