Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 16:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://trk.klclick1.com/ls/click?upn=T5BSEufkXOzn1xHnzZR8-2FeLGjfKuH651HgGqVwYbwx1XRImUkcf6kGHFk0NYKIKZ7e3BKD7LOIsuDQnv-2BbiZqSfVXQqcYz91LlQfvAGhkMGjceYFtUUuoRQw9NqNBzY1biP8wWibO6oXqPxtKO7Ohg-2B8a10zZgd1HBu-2F-2BXe6c5MRvUNn4z8EQupXvJMrSOPjRTQu_XvMkrOcA3DD03EcPr0dbzsxir8ZrDC4XVnwz-2FZptGK4HzymGr6p25amJKJko-2BzoxoRdtnrdWrPxPcjKk-2BwWW2D1WBSnlxkmxY-2FEzqxI2NrmD4nFvUR0RdOw-2FlJ0ybjGBL20kHWxiMPnoYjXDgz21QUE5KjwkC8LA4PPffIdwTXGZ9NigD0XvkE8uqG7INl6GUcUf7D-2Bewm4kGjYK3yztXqM8DB3wDL1Bz5Zcz0472ASdvHS4-2FH2Qbl0bUeostcXtMnLK6tD8HgvegKLB98KFhGuapcqWmmdEKJzrUW0TSz0KoJ5ZpjpesWWiZop4RQKk2-2BcSXrHeo4RCnYoC7FANFtXQwW2SS6YxsXSvB7qIPIlfETssbJ74s-2BA8V-2BnGyC-2FAI14wQqQoAqNy-2BrvvcCtgZR5zgp1uvVB9Yf1UXfZUQAHNQvATUD8yHuMRZoPohgTFvTjOB3urnk5BN3qAvEiKIA-3D-3D
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://trk.klclick1.com/ls/click?upn=T5BSEufkXOzn1xHnzZR8-2FeLGjfKuH651HgGqVwYbwx1XRImUkcf6kGHFk0NYKIKZ7e3BKD7LOIsuDQnv-2BbiZqSfVXQqcYz91LlQfvAGhkMGjceYFtUUuoRQw9NqNBzY1biP8wWibO6oXqPxtKO7Ohg-2B8a10zZgd1HBu-2F-2BXe6c5MRvUNn4z8EQupXvJMrSOPjRTQu_XvMkrOcA3DD03EcPr0dbzsxir8ZrDC4XVnwz-2FZptGK4HzymGr6p25amJKJko-2BzoxoRdtnrdWrPxPcjKk-2BwWW2D1WBSnlxkmxY-2FEzqxI2NrmD4nFvUR0RdOw-2FlJ0ybjGBL20kHWxiMPnoYjXDgz21QUE5KjwkC8LA4PPffIdwTXGZ9NigD0XvkE8uqG7INl6GUcUf7D-2Bewm4kGjYK3yztXqM8DB3wDL1Bz5Zcz0472ASdvHS4-2FH2Qbl0bUeostcXtMnLK6tD8HgvegKLB98KFhGuapcqWmmdEKJzrUW0TSz0KoJ5ZpjpesWWiZop4RQKk2-2BcSXrHeo4RCnYoC7FANFtXQwW2SS6YxsXSvB7qIPIlfETssbJ74s-2BA8V-2BnGyC-2FAI14wQqQoAqNy-2BrvvcCtgZR5zgp1uvVB9Yf1UXfZUQAHNQvATUD8yHuMRZoPohgTFvTjOB3urnk5BN3qAvEiKIA-3D-3D
Resource
win10v2004-20231222-en
General
-
Target
https://trk.klclick1.com/ls/click?upn=T5BSEufkXOzn1xHnzZR8-2FeLGjfKuH651HgGqVwYbwx1XRImUkcf6kGHFk0NYKIKZ7e3BKD7LOIsuDQnv-2BbiZqSfVXQqcYz91LlQfvAGhkMGjceYFtUUuoRQw9NqNBzY1biP8wWibO6oXqPxtKO7Ohg-2B8a10zZgd1HBu-2F-2BXe6c5MRvUNn4z8EQupXvJMrSOPjRTQu_XvMkrOcA3DD03EcPr0dbzsxir8ZrDC4XVnwz-2FZptGK4HzymGr6p25amJKJko-2BzoxoRdtnrdWrPxPcjKk-2BwWW2D1WBSnlxkmxY-2FEzqxI2NrmD4nFvUR0RdOw-2FlJ0ybjGBL20kHWxiMPnoYjXDgz21QUE5KjwkC8LA4PPffIdwTXGZ9NigD0XvkE8uqG7INl6GUcUf7D-2Bewm4kGjYK3yztXqM8DB3wDL1Bz5Zcz0472ASdvHS4-2FH2Qbl0bUeostcXtMnLK6tD8HgvegKLB98KFhGuapcqWmmdEKJzrUW0TSz0KoJ5ZpjpesWWiZop4RQKk2-2BcSXrHeo4RCnYoC7FANFtXQwW2SS6YxsXSvB7qIPIlfETssbJ74s-2BA8V-2BnGyC-2FAI14wQqQoAqNy-2BrvvcCtgZR5zgp1uvVB9Yf1UXfZUQAHNQvATUD8yHuMRZoPohgTFvTjOB3urnk5BN3qAvEiKIA-3D-3D
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500693716704619" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4876 chrome.exe 4876 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 2856 4952 chrome.exe 17 PID 4952 wrote to memory of 2856 4952 chrome.exe 17 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2844 4952 chrome.exe 30 PID 4952 wrote to memory of 2276 4952 chrome.exe 35 PID 4952 wrote to memory of 2276 4952 chrome.exe 35 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32 PID 4952 wrote to memory of 3724 4952 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d5b59758,0x7ff8d5b59768,0x7ff8d5b597781⤵PID:2856
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trk.klclick1.com/ls/click?upn=T5BSEufkXOzn1xHnzZR8-2FeLGjfKuH651HgGqVwYbwx1XRImUkcf6kGHFk0NYKIKZ7e3BKD7LOIsuDQnv-2BbiZqSfVXQqcYz91LlQfvAGhkMGjceYFtUUuoRQw9NqNBzY1biP8wWibO6oXqPxtKO7Ohg-2B8a10zZgd1HBu-2F-2BXe6c5MRvUNn4z8EQupXvJMrSOPjRTQu_XvMkrOcA3DD03EcPr0dbzsxir8ZrDC4XVnwz-2FZptGK4HzymGr6p25amJKJko-2BzoxoRdtnrdWrPxPcjKk-2BwWW2D1WBSnlxkmxY-2FEzqxI2NrmD4nFvUR0RdOw-2FlJ0ybjGBL20kHWxiMPnoYjXDgz21QUE5KjwkC8LA4PPffIdwTXGZ9NigD0XvkE8uqG7INl6GUcUf7D-2Bewm4kGjYK3yztXqM8DB3wDL1Bz5Zcz0472ASdvHS4-2FH2Qbl0bUeostcXtMnLK6tD8HgvegKLB98KFhGuapcqWmmdEKJzrUW0TSz0KoJ5ZpjpesWWiZop4RQKk2-2BcSXrHeo4RCnYoC7FANFtXQwW2SS6YxsXSvB7qIPIlfETssbJ74s-2BA8V-2BnGyC-2FAI14wQqQoAqNy-2BrvvcCtgZR5zgp1uvVB9Yf1UXfZUQAHNQvATUD8yHuMRZoPohgTFvTjOB3urnk5BN3qAvEiKIA-3D-3D1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:22⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:82⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:12⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4780 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:12⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5152 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:12⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3924 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:82⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:82⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:82⤵PID:5412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1872,i,15857752507451892944,595262335676287709,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4876
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3176
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x438 0x3181⤵PID:5144
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:2860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:5612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ff171a57594317b7cd2ca8afcc3797d0
SHA1fc636375d5a697a3f4dec8c7ca52be2e4223bb44
SHA2560b221fa10f72068eb907d0c6e4094b5b68a2d58c6adae240637d96856b3c0de2
SHA5126b6e7412f8520a3027a302e85b30b107833b02cf7a65fb00ce6c579811413e795adc704b1917e9ba6434fab420ec1194c253872026442a427b0a86696f2cc966
-
Filesize
7KB
MD5da44b66f185300865cc8b2bad859b7c7
SHA1b8a58659b25fc6cd057fae33c1fbd13a2f03c4e5
SHA256f115a0c18ad76d5719cf7853e5ce2d8720ed9cfef4ee0e7b197d7d12f8f79f1d
SHA51229f1f8e0be858274f0313afd26632cca802ee6195e58bf0d9d99cedce4e11b1a7603054edc7f2b01b0204120aa9bd466b173d627d6949c9e575cc40c62d1c0fb
-
Filesize
2KB
MD50ff988eb2f504e41bc2e32f8bdeebb90
SHA1418d0fdf4d1487d19347af57e250ee587f543ebd
SHA25678a9384bd45ec42be2f05c71771abb66f34b72c8b4722f7eab32482e471a2bd2
SHA512a50bda5c21031e2b77403ba76ca4e400da3e6cb3c3f8f00ae75d4309fc95a6b5cbf17b26b17f17431b85dab3c83a5aca48ff223adbd09492056d39134782a684
-
Filesize
2KB
MD546f24b4c149f5ab4f7e3643a5f4a3c24
SHA14b75882f468882ba731b65b12f7264c4f9f31751
SHA256489a99b72ee55afdc6ec96733140832ea1dda4bcc7e3685f006db39ff3afa676
SHA512c79bbdf0653860e26f62d03dc86a1ad625d0393ecedf279ba4f58131b44e456ebebde8e8bf4c2e3ba16a3c5051253c54a0b5bcf607251d9e8312091794af6c74
-
Filesize
6KB
MD526179c8c0d917255f0b56ee793a7b2c4
SHA1497ffa851d307ead69a433a1fda4341faa08ad13
SHA25613d5f0708111afc47625c6eb71a00bfd2ae10f4ba333c6d43b9916a11eac7d8a
SHA5125a80bf41e8d649e727390c9ce3370aeeef002494cdffb91e434ee5092dffebd1839b895b9815279d74e816f6117a1d1f43e9bd05d86f5635aa61f3b60fe401e0
-
Filesize
114KB
MD5f4f15b6288598c78eff8633ebb8a5de8
SHA1d2d2ca543449d9019d0987ae4740cbaf16df5c8d
SHA256faf992fe50a4d87595d5bec044b5f6d6c81a1984883ffa4e6b39fe96e9a67d74
SHA512e86fc9684052e4aceda26006d9a04942d8dcb9908ac6952a5854d1ca265358cec663336b38bf002bd22e73fe3b9e18a0f0d2ef2c40ca07408fcf5ef6af3420a9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd