hxxps://yg1back[.]site/Bin/support[.]Client[.]exe?h=yg1back[.]site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQChALOp+/G8P69Eaomtsf2GxWdWCPkaBKWICAkaUKJpP5xBPpGHOJD8tfr61fLQmcLNHTx6iBcVAGUiWYgjIy/SsnVMWnYcwVcW+asq6Flf5JJSFx7/AA0BSI4dSrndAja8+zd1EOG/TbUDJVA0GStu+uMgHUViUaCAeq9Rq7k6laWlajb0YIfDQJwEUPDxtLoT7tooVevKmxgF/pBGS/a9JGpLSKTL3HDrcPiyCxUwwYzXiWSRQJp2jCYHI0KM4zJUOWuMdpqBvfqkF1IGWZq9358Dre17GuMpo6Sl/3e/qUcPS9J3Cp4Hw/7TvkMiHqRCeK1Qxslq5/ux5FxEmL/n&s=02707a9f-42c7-4a19-81bb-973e915c5491&i=Untitled%20Session&e=Support&y=Guest&r=

Resubmissions

09/01/2024, 19:07

240109-xsrzdaaag5 1

Analysis

max time kernel
298s
max time network
299s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
09/01/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://yg1back.site/Bin/support.Client.exe?h=yg1back.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQChALOp+/G8P69Eaomtsf2GxWdWCPkaBKWICAkaUKJpP5xBPpGHOJD8tfr61fLQmcLNHTx6iBcVAGUiWYgjIy/SsnVMWnYcwVcW+asq6Flf5JJSFx7/AA0BSI4dSrndAja8+zd1EOG/TbUDJVA0GStu+uMgHUViUaCAeq9Rq7k6laWlajb0YIfDQJwEUPDxtLoT7tooVevKmxgF/pBGS/a9JGpLSKTL3HDrcPiyCxUwwYzXiWSRQJp2jCYHI0KM4zJUOWuMdpqBvfqkF1IGWZq9358Dre17GuMpo6Sl/3e/qUcPS9J3Cp4Hw/7TvkMiHqRCeK1Qxslq5/ux5FxEmL/n&s=02707a9f-42c7-4a19-81bb-973e915c5491&i=Untitled%20Session&e=Support&y=Guest&r=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133493008593065616"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe
Token: SeShutdownPrivilege	1764	chrome.exe
Token: SeCreatePagefilePrivilege	1764	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 196	1764	chrome.exe	74
PID 1764 wrote to memory of 196	1764	chrome.exe	74
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 3556	1764	chrome.exe	78
PID 1764 wrote to memory of 4480	1764	chrome.exe	76
PID 1764 wrote to memory of 4480	1764	chrome.exe	76
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77
PID 1764 wrote to memory of 1920	1764	chrome.exe	77

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yg1back.site/Bin/support.Client.exe?h=yg1back.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQChALOp+/G8P69Eaomtsf2GxWdWCPkaBKWICAkaUKJpP5xBPpGHOJD8tfr61fLQmcLNHTx6iBcVAGUiWYgjIy/SsnVMWnYcwVcW+asq6Flf5JJSFx7/AA0BSI4dSrndAja8+zd1EOG/TbUDJVA0GStu+uMgHUViUaCAeq9Rq7k6laWlajb0YIfDQJwEUPDxtLoT7tooVevKmxgF/pBGS/a9JGpLSKTL3HDrcPiyCxUwwYzXiWSRQJp2jCYHI0KM4zJUOWuMdpqBvfqkF1IGWZq9358Dre17GuMpo6Sl/3e/qUcPS9J3Cp4Hw/7TvkMiHqRCeK1Qxslq5/ux5FxEmL/n&s=02707a9f-42c7-4a19-81bb-973e915c5491&i=Untitled%20Session&e=Support&y=Guest&r=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffae6f19758,0x7ffae6f19768,0x7ffae6f19778
  2⤵
  PID:196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4884 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=832 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=688 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1676 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5528 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5680 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5640 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5680 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5984 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5656 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6128 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5508 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5680 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5828 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2992 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5232 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5372 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=868 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5500 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=2984 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2888 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5756 --field-trial-handle=1824,i,14940497302374126283,408144650465414258,131072 /prefetch:8
  2⤵
  PID:656

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3d328378-116d-4d5c-9700-15a080b0a376.tmp

Filesize
114KB

MD5
2531d3d1f79c9960620f2cfc364ff3b8

SHA1
eaabdcf14ab8da3003ac8db9a3a3de6de7297dcb

SHA256
55e9bfe014a307bc5c8f7cba05cfcc739d67f32d292af7410a6d09186b4d5888

SHA512
92d3bc0c5a8989cdb7ceb09928214dd697773b75f18370d7c5c75d19d5f7ae5e488e03fd56b0583a3d97206bb7512a62463bd7bd2d8e9d6d33ff2c85acfb6141

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\837b1886-c1f0-4ea0-b97f-54057583a946.tmp

Filesize
114KB

MD5
e737fc5e8db45f177256eb6ff01ea90c

SHA1
ab7ace648e9b5af10833ed0889ae78f24a17eb71

SHA256
1e3ad73dd636c8fe9f231c19e4257f0a551fa79d48c12450f50ecb838131d6a3

SHA512
db8339399edc5258c453421431f15b83769ae20deb62624601bccaed4ec92f5674d9798b387718c20ccc5282b4e808aa46e5bc7c1ebeee62f6443b9105f032b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
201KB

MD5
e3038f6bc551682771347013cf7e4e4f

SHA1
f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

SHA256
6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

SHA512
4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d6cf3d18e5366eb25bd0db653131d60a

SHA1
49365a3dd21e355b2eb5d831e606a64be105e2d0

SHA256
6d476b899c35e3b086219f0b5715fdced805aafd5aa9b22b6306094f21136a85

SHA512
7563bc95f37658c66dc90a3b72054df1e1b5056c43f68f0782bc403aa6e0a696c5e8d62afeb5173823a2e8a558978f76dc5e3284570771cde21ed8d6e0b3e078

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
613860523b60377bb2c69d4ecb7b8c14

SHA1
4ba368aecbec0203fb184f352ddb0e99ff23e24c

SHA256
7ba23ff4f31b26f884f37edc0c7249b217861976f87897de3d62a851c0079cc3

SHA512
404fa9aaa1bf46d34f12d36cec7541c4f7274d15f2815eab028561cc563771a09268fcdab50ced913c980b6c2dd72a47b32da41f623cdf6cb337b285a0156845

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b3397920dea0d48c8990e2c035f590e0

SHA1
64e5077c28301e23069003085f7c8d7636bdffbc

SHA256
3964f31f2f1ca1ba51b562336b923d4a8dd4a5ffea5d0eb61f18d06728e02bd2

SHA512
be536ed977059a725bbc84e62aad27b379f3a95e27024832792f4fdadf4deda4d475825496f1c82161004da7090c39d29800ca6ab6f1cc894d37c1899331624f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e0855ea7d2ce7d926b6f390664a1ca12

SHA1
87fa448d60b8befe5639b8835381fde587c34e53

SHA256
ee2167bca5887d79fd61370b5bf56a4794a9cf26587d093f4dd7928d2c8168ae

SHA512
aabe44b26a2d31c04241d79f92304058b06d9bc1de05e2e53b7de0e01f36f0f15d3747bb1ebcc023e0d6f76db48dff7c73fc01c9ef57b22174778ad9e106f17a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d626a072fa6d097b85e4bded5ec9cab4

SHA1
206d6ed206ac9281020008f1a01c9b60cf1e6f20

SHA256
aebe2d0c4c3787e1c745369443647602f7797c424a5eb49252905b2dda51c484

SHA512
4ec463f05aa4ce58b8621362811fdbb01982e90387a12f212a745d12880c1a0b52454fce895140e68819077cb9ea479d401e51f887b14c57da676ee223e219e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
6f98abe7d8e124105177681056cf2d9c

SHA1
69b6ad271c7ac09a03031ac95a3c715fbb5b6fc5

SHA256
d36ba2c846abbf4bc082af07e00d7872f1527e3351f1566c8db59f542df5e292

SHA512
11dc1609dff5d4fbabd91128d8df8309c680ca977523154898800663969dfdb39a16119966f566e090b78c87f9d2f785a3dd4d4c1726215391b3b2dda5401da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
cae66c5483e390d5d60418b2d4b6143f

SHA1
59fdf179be3a9ea92d2e7e561daee40f388ec4fb

SHA256
64a0f304babc516998901100d41de4d07677731420c8d157719088a285667a60

SHA512
6a80cec3e40d416cbc76ac3f94c4dda205487c4183cd24b444f0d02ee9f86830625af06e1ee34b67718bf382cebb6c66a038df40f7b5a66215d7cfd2868674cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
a6c284319e4e41664d2999ce8180c2fa

SHA1
46727a4b0eda280aada69aae151a73424b75e3d9

SHA256
3d53d7d58e13c077e7f308ed42fd1deb959f319c0f08e1518a9a3b72aff9114c

SHA512
3b61311f7a63e144944e4be0c07738f1aa69acb756d2164d3acf6b5c8eb6031dfd15d09bd32b6e0a5b047b7aa068f668f211fc06f89e102b1e73e51f7dd35c3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e9af380de0cd7466ee805e28144361ef

SHA1
06f5188d9eb8b8f4198143772ed949caec64de24

SHA256
bb8994b7cc397ec02c52a803069c7d3a33accb6ff57334382374936bef60e07f

SHA512
aea94d327dba33eebdae7bc7e5b7db3b8940aa8d77ce7e013b27f56d1824d2b902a4ac8092f46457bc8cad27d4ed2d1b042809f37eaa95f16977d2feeab6edbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
55ad7288f51eae8b8bb002f4262f4aa9

SHA1
28670aa8ca0802b8f476d8e6c8197b1a4555cffa

SHA256
a44a9c945a8d7cb50e0a640687bf7f3cfe92264fbbd93ce5460ef8ce132b711a

SHA512
2083e013272529c576d4de7e7ac7a195e4d5cb2e241910feead3342dea0ce2960fad2526fcb3c53e678364dc5c97b6f0a47faad696804258cf376cb6162288a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6f9d785ff63682d4603ace391bd6ffe5

SHA1
e4c2405cff987efecffb8445d84f715a3cb31a5c

SHA256
b833782e3afb8d5148f4ea56179a816f6ec5dd174748019f88ac761e6db7fafb

SHA512
bca550870fdd62a56a07b05805a16db5554bc75681de8ec9163896977dd59aef99e396a2233a6e7e39b3f61df8c0a9f0791414779006e1cfd4901d8561255964

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
fa904dcdb5846162db5909b7649b5c66

SHA1
24ed0881237981bad990a17aed3ee29f338e8036

SHA256
6c7ce48b675bf2ca2b1a024a1bb25c42d7e72bfaea8a740af1b05e18920114ba

SHA512
caa294639c80b13b9d60d9b564e77439dd5d376625a7b77ec34fae916351d199fe45271ff4a89e8ed055c1b431733bc7f43534307d892dd18a9c6488200e212c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
978ccbb21c2cf1c040ebe436e3cdf1fb

SHA1
a5a868a9c13f41ecc779d449656a76d2dec4eafd

SHA256
a824c668155c37e3e2f434aaf2dc1c553453aba4ec3269078bcc319c832094b0

SHA512
d6ccf4a706186cad7a03e52c620f19d8c804219e1e395fe623531b546350e852d0569c40936df59d12a311610844e41dc5cc19fc8447d351a132e80e4de71328

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
dc31a0590259d72e1434f1097a426483

SHA1
3f173c30290d2fff75741bb936dd1c9fe608633e

SHA256
34c4f0ced3f158c1a1c0923fd28441b21eca6d09634da91c9d9b54d8aa791099

SHA512
2435b949d6648ac0928764c9b51a22c132e5334d19a53e7c798c58cf7c2ca6fb2ec81f0efa3e3e4233ab6e373e3d4c0800e3d573d365fe842f81dca7cbcf6b21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a08cb.TMP

Filesize
48B

MD5
9919695eb45cdc276f20ce9cfc10a2ea

SHA1
71ffa16b4796848035e4cdf18252ae9195b15b74

SHA256
56ab38255c302b36ff6c0eeb0dc44df562f15de742b6845052010c3a34f9c0d0

SHA512
c37906878cf19d722c39415b8563e38bc99007b6ce30478a4438971a15ab5902fe5f3a5db2a59abe29334731332332f144bee2754131ca3d820cbb8ad73383ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
9a25685f4c9376735c3b53682c5c947e

SHA1
955e1981808ff9fc16dcb185cf0cbe4dbd4f7487

SHA256
949134fc8e6fe2a03d4417aa6c17f222c06ffeed705fd690d241ddfcd4a2895b

SHA512
dd2971c132aa458ab972d18e7f13cc1141d1f81333598920129ac13273e669fd9693974964214d3ae8397275f1487cc0b90f8b7565cecd8d0064c5ca04792c36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59dcba.TMP

Filesize
100KB

MD5
87cd9d4eba82b113e3eceb48ac1213cd

SHA1
c072142de0eee41b7acdb546896d2ec8501466ce

SHA256
ffe024f3b0b543b57e20352abfd7c6a364dc5bbeec51be4b679de7584f3d1256

SHA512
2f0b073999f868a779f01531aaf1b19eca78c676f9c2e0f9709af0fab291f9f3012cfb27c19c420be3dc852b5aa784f72d4786f36fb8f22a5e010ef963695476

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\support.Client.exe

Filesize
84KB

MD5
eacfddce7b6723be10300561575ab2fa

SHA1
7285b93933a6975e0ecf972051006460d071c224

SHA256
be99097aac3c416961e734564c8abe7281f1932c08363ef82a977ba9441b14cd

SHA512
b6f8d06967e32dea0c79c772a10d0c7540b34718c53030547abc9499108f89a0db2999476316f969f061f94a9c7ff7267335cf7d694ec4a1c84b7b05435f88a6

Download Submit