Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 23:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://analyticsinhr.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuYWloci5jb20lMkZibG9nJTJGaHJtLWJvb2tzJTJGJTNGdXRtX3NvdXJjZSUzRGFjdGl2ZWNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NhbXBhaWduJTNEd2Vla2x5LW5ld3NsZXR0ZXIlMjZ1dG1fY29udGVudCUzRG5ld3NsZXR0ZXJfd2Vla18zXzIwMjQlMjZ1dG1fc291cmNlJTNEQWN0aXZlQ2FtcGFpZ24lMjZ1dG1fbWVkaXVtJTNEZW1haWwlMjZ1dG1fY29udGVudCUzRCUyNUYwJTI1OUYlMjU5MyUyNTlBJTJCMTclMkJNdXN0LVJlYWQlMkJIUiUyQkJvb2tzJTJCJTI1MkIlMkJQZW9wbGUlMkJBbmFseXRpY3MlMkJSZXNvdXJjZSUyQkxpYnJhcnklMjZ1dG1fY2FtcGFpZ24lM0ROZXclMkJXZWVrbHklMkJVcGRhdGUlMkIlMjU3QyUyQjIwMjMlMkIlMjU3QyUyQldlZWslMkIzNA==&sig=3KRew3feAbsCnWknkAFcUTgfkWmTe2D4QWDUWY4can9U&iat=1706111962&a=%7C%7C223476493%7C%7C&account=analyticsinhr.activehosted.com&email=XZsagAvnb7p%2BJsdif4qbWWqNNCcnsjrSew%2F%2FIiBRy6skSC5sdxPNeUVFjVI%3D%3A%2BRikO4kTfNckr7DSDolWfofC4Sr7UH%2Fs&s=caa78d711163a13a389de1c073586609&i=1939A5776A84A32216
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://analyticsinhr.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuYWloci5jb20lMkZibG9nJTJGaHJtLWJvb2tzJTJGJTNGdXRtX3NvdXJjZSUzRGFjdGl2ZWNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NhbXBhaWduJTNEd2Vla2x5LW5ld3NsZXR0ZXIlMjZ1dG1fY29udGVudCUzRG5ld3NsZXR0ZXJfd2Vla18zXzIwMjQlMjZ1dG1fc291cmNlJTNEQWN0aXZlQ2FtcGFpZ24lMjZ1dG1fbWVkaXVtJTNEZW1haWwlMjZ1dG1fY29udGVudCUzRCUyNUYwJTI1OUYlMjU5MyUyNTlBJTJCMTclMkJNdXN0LVJlYWQlMkJIUiUyQkJvb2tzJTJCJTI1MkIlMkJQZW9wbGUlMkJBbmFseXRpY3MlMkJSZXNvdXJjZSUyQkxpYnJhcnklMjZ1dG1fY2FtcGFpZ24lM0ROZXclMkJXZWVrbHklMkJVcGRhdGUlMkIlMjU3QyUyQjIwMjMlMkIlMjU3QyUyQldlZWslMkIzNA==&sig=3KRew3feAbsCnWknkAFcUTgfkWmTe2D4QWDUWY4can9U&iat=1706111962&a=%7C%7C223476493%7C%7C&account=analyticsinhr.activehosted.com&email=XZsagAvnb7p%2BJsdif4qbWWqNNCcnsjrSew%2F%2FIiBRy6skSC5sdxPNeUVFjVI%3D%3A%2BRikO4kTfNckr7DSDolWfofC4Sr7UH%2Fs&s=caa78d711163a13a389de1c073586609&i=1939A5776A84A32216
Resource
win10v2004-20231215-en
General
-
Target
https://analyticsinhr.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuYWloci5jb20lMkZibG9nJTJGaHJtLWJvb2tzJTJGJTNGdXRtX3NvdXJjZSUzRGFjdGl2ZWNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NhbXBhaWduJTNEd2Vla2x5LW5ld3NsZXR0ZXIlMjZ1dG1fY29udGVudCUzRG5ld3NsZXR0ZXJfd2Vla18zXzIwMjQlMjZ1dG1fc291cmNlJTNEQWN0aXZlQ2FtcGFpZ24lMjZ1dG1fbWVkaXVtJTNEZW1haWwlMjZ1dG1fY29udGVudCUzRCUyNUYwJTI1OUYlMjU5MyUyNTlBJTJCMTclMkJNdXN0LVJlYWQlMkJIUiUyQkJvb2tzJTJCJTI1MkIlMkJQZW9wbGUlMkJBbmFseXRpY3MlMkJSZXNvdXJjZSUyQkxpYnJhcnklMjZ1dG1fY2FtcGFpZ24lM0ROZXclMkJXZWVrbHklMkJVcGRhdGUlMkIlMjU3QyUyQjIwMjMlMkIlMjU3QyUyQldlZWslMkIzNA==&sig=3KRew3feAbsCnWknkAFcUTgfkWmTe2D4QWDUWY4can9U&iat=1706111962&a=%7C%7C223476493%7C%7C&account=analyticsinhr.activehosted.com&email=XZsagAvnb7p%2BJsdif4qbWWqNNCcnsjrSew%2F%2FIiBRy6skSC5sdxPNeUVFjVI%3D%3A%2BRikO4kTfNckr7DSDolWfofC4Sr7UH%2Fs&s=caa78d711163a13a389de1c073586609&i=1939A5776A84A32216
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506128513704701" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5020 chrome.exe 5020 chrome.exe 4312 chrome.exe 4312 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe Token: SeShutdownPrivilege 5020 chrome.exe Token: SeCreatePagefilePrivilege 5020 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe 5020 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 5048 5020 chrome.exe 64 PID 5020 wrote to memory of 5048 5020 chrome.exe 64 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 1644 5020 chrome.exe 88 PID 5020 wrote to memory of 4672 5020 chrome.exe 89 PID 5020 wrote to memory of 4672 5020 chrome.exe 89 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90 PID 5020 wrote to memory of 4064 5020 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://analyticsinhr.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuYWloci5jb20lMkZibG9nJTJGaHJtLWJvb2tzJTJGJTNGdXRtX3NvdXJjZSUzRGFjdGl2ZWNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NhbXBhaWduJTNEd2Vla2x5LW5ld3NsZXR0ZXIlMjZ1dG1fY29udGVudCUzRG5ld3NsZXR0ZXJfd2Vla18zXzIwMjQlMjZ1dG1fc291cmNlJTNEQWN0aXZlQ2FtcGFpZ24lMjZ1dG1fbWVkaXVtJTNEZW1haWwlMjZ1dG1fY29udGVudCUzRCUyNUYwJTI1OUYlMjU5MyUyNTlBJTJCMTclMkJNdXN0LVJlYWQlMkJIUiUyQkJvb2tzJTJCJTI1MkIlMkJQZW9wbGUlMkJBbmFseXRpY3MlMkJSZXNvdXJjZSUyQkxpYnJhcnklMjZ1dG1fY2FtcGFpZ24lM0ROZXclMkJXZWVrbHklMkJVcGRhdGUlMkIlMjU3QyUyQjIwMjMlMkIlMjU3QyUyQldlZWslMkIzNA==&sig=3KRew3feAbsCnWknkAFcUTgfkWmTe2D4QWDUWY4can9U&iat=1706111962&a=%7C%7C223476493%7C%7C&account=analyticsinhr.activehosted.com&email=XZsagAvnb7p%2BJsdif4qbWWqNNCcnsjrSew%2F%2FIiBRy6skSC5sdxPNeUVFjVI%3D%3A%2BRikO4kTfNckr7DSDolWfofC4Sr7UH%2Fs&s=caa78d711163a13a389de1c073586609&i=1939A5776A84A322161⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe34879758,0x7ffe34879768,0x7ffe348797782⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:22⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:82⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:82⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2800 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:12⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2792 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:12⤵PID:1208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:82⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5296 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:12⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3824 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:12⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 --field-trial-handle=1892,i,16295678665698676186,5782311931792455173,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201KB
MD5c445ab4315d0633d446998c80764cc36
SHA147d3dee9845cc6e29b6771dd6560793b8b93000e
SHA2565635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242
SHA51283a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1
-
Filesize
1KB
MD5044d363c4c56e4b863c9f44001b98cd6
SHA1bff097972db7071b938707688e4a3537637ce7d7
SHA25650989fe0a41a3a4ad2473ad210cdbdd7a9430b6468848afee407b199ad9ee940
SHA51293f566f81809a82c71e4b5943b4587ebcc5f0ac6154817625173135b3713e5de5b5979202cdaaa55f863a70415101323bba0e9ef8d2f9f0e06ae1341826765cf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\248ef447-8fbd-4fd1-8235-7ed8d18ec224.tmp
Filesize2KB
MD5658c617aebd225da02543a5d1c7a3a05
SHA120e597234e9d64cd3535cedd33d822c8a96086f5
SHA25680234354ea82218bf5059c5d78632d10d0496b6b72e343899544098628ca44d3
SHA512b8d49db206191dfcaf06e7c3206bde44826b926dd5869d43006e98c5de9589cc499ec909485d17351724e7dee0b63c391c3c209e43ece42dcaecf491f0fae54a
-
Filesize
5KB
MD59327add07b1a6c497735de290dffdde1
SHA12f787d7463a9a394dcd7f755c51bfd559376875c
SHA256d46f909350e8bb59b862c5f5d668c14325e75fa2c9af82f5dc85c4af839f9ed9
SHA5122bddb2cc6b3b33a469c06e92b50497ddaeefca0d10d5da565e1538de86f600b7cd9edb318c7ace59f92c53e00ff1376309a34148a848fe5c335d430a6dc00966
-
Filesize
5KB
MD515c05d87880bef7e2b4b5d5f3a8939c2
SHA1c734cd05f65aad04e67983c81dda5310cae07167
SHA256a68b1de6f799879b6babefc20787c4a98bf4c447dfa53a74690900123e8338ed
SHA512efb658a69518fc52ffad10e90337cadc0d3ef02b3204d819c63ae2c51293bc85784024d6d03ca12756745012c33ab743070d16c943b6413e6a03b3cf413fa167
-
Filesize
2KB
MD5c0a9f6a6e5d5e9a631567c507772407d
SHA1aeeb92adfa9baa616a0ba3e7200557827b3279cd
SHA2568b2f4fb7fc3386ac6c439af90ea139c40f334add0d35aa0928d7b602fd356613
SHA512c04d21efe6b0da1aca9c9276fd6f55b917703d6225d9dec97920f2b6103627fc994055b891d744a580df372b511e225de226bafec8e0fd72d38acf559ed51ebf
-
Filesize
1KB
MD5b9a97f60ccc1d9d60ecc4c3c3ebc8819
SHA124bdce47b3b13f62800ac656a0738b5f7c43738a
SHA256ee8fd68b5d36fceb4db019f2c2707e2c0833931157de7555520e902b653550dc
SHA51273f9feb2265eb08d51fa53ebc013f59a8a0f50449758876acf41bb3137f89d1c3e92d5a6648b853122ec9a0d79a3345db7e85cdd718e30b7f743665ac29fcf6a
-
Filesize
2KB
MD54b87c83a366fb936ec2ddd261b617942
SHA1cf54bbeee06ad9d747e08a243565500287d7c4ae
SHA2568ad48868ca919b8b21cc9f8e7efd9f623e2a537e64260c0a6e4aed683fa10d85
SHA5129c340b90691d96c8c3aaa9036f70ea09d85df78fdf619b61aff115e8bac05e184af26f8fad9a37b51abca267f0e00cfb81e7156f8e9fb8d2fa57eb25fee42468
-
Filesize
6KB
MD52631489a38c63289367b60f85d89209a
SHA10b33fa2c52f9229244b86c9d8a0c316406cb89d0
SHA256a65ad7184ea94979554f7395e13ced872e482f03c63596ba6fffb5bfa59a15c1
SHA512b4f39b1ccd1b0f53b3af8232752bf43a730a3f08f0f9daa87813c4349cbcd73c21758765214590b93460d1b54bd66248dc4c351080da2e7841385234297a2b35
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD596079a41ee72f8156b4495754f4e1c76
SHA1bdbe136419b6be463ea9318e8e028eaf559da8a1
SHA2563dd76a3a5ec669f8dc1aadf4c3d50f8fb83fdc24d25fcbb1ca4f1ff64ace8756
SHA5121c4000a5be059a6f53fbc9b441b6a8c5b6ea5ad38341496583c2d2a08bb2eeb5da9c01c2d2dac06507b6d5450c1cfbe38ee3f9ef413011b4c2af03468d810c95
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583795.TMP
Filesize48B
MD575164042787f9b1ea6bdd0de3610ce19
SHA1aaf3f87f9d855992dc946b3ae847a5a63a6aa091
SHA2560b23d54dcae8167d3531238097784ae576584513d2e7a9e0653b1d22ec597f8a
SHA512f863750e47623634864174299488686efbd9bc29b8fab39a5a004b81575f3e7901eea3c3ae59fc6ade305dfa9b45267efe5365f25db11f45f9d5e43df04674b9
-
Filesize
114KB
MD530e3b779358ea82de0ef6f61c7d6a496
SHA1c7902e1d10528384cbff533f795fe2ce48922d6e
SHA256115fbbf10b19156e656509ce9e1903a62473842f4dc31cd91d0cf4a7e6efc67e
SHA51221528f89c2bdbaa8cc7395d952d5e16eb9ff8345c1cc3b4a9511e2d57fc9500b637e9f83ca21706bd45ad6bcf562ce8b0b8c869a82fe3261201f4790cf795c56
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd