Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/04/2024, 22:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe
Resource
win11-20240221-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe
-
Size
1.1MB
-
MD5
e2c0063eabdf7b46878c33e5cb9c3c36
-
SHA1
5e116cdf76996369009e6cbfd6e4a2db6dd42f43
-
SHA256
75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e
-
SHA512
a1674e24774f505eaaed0b3053cc7b4d8c3adb4adf25f3593facd5890432bb99917f54601138227ed8e36ba5decd7b7bfeb8d5ec028bf6c0cd50bf2de7086425
-
SSDEEP
24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8a3w2+b+HdiJUt:aTvC/MTQYxsWR7a3w2+b+HoJU
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133570872159264967" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 1616 chrome.exe 1616 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe Token: SeShutdownPrivilege 4136 chrome.exe Token: SeCreatePagefilePrivilege 4136 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 4136 chrome.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 4136 chrome.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 4136 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 80 PID 1276 wrote to memory of 4136 1276 75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe 80 PID 4136 wrote to memory of 2860 4136 chrome.exe 83 PID 4136 wrote to memory of 2860 4136 chrome.exe 83 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 3468 4136 chrome.exe 85 PID 4136 wrote to memory of 4948 4136 chrome.exe 86 PID 4136 wrote to memory of 4948 4136 chrome.exe 86 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87 PID 4136 wrote to memory of 4612 4136 chrome.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe"C:\Users\Admin\AppData\Local\Temp\75b83e31bf1fbd3c41b9f4d8d5dc7d8196b6f56405c05d254511c85bd7c4df9e.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8879e9758,0x7ff8879e9768,0x7ff8879e97783⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:23⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:83⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:83⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:13⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:13⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4544 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:13⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:83⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:83⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:83⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2612 --field-trial-handle=1824,i,8484697281183150707,1568915096789550380,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD578d213e765355af0afef132b750042d8
SHA1cb6ce469070456bdc226370357021e59880b4332
SHA2561b291a0a6bfa5736ff7cb67b9a1471f146a630153a4d324464c8081e868b734a
SHA51242ccba766eb84f0a87fa86ea2673d3f87d10de02e3a158bdd70a5d410363a3bee7626a36a7700a169996833493bdb0937392b9cefe658ac997088f68e3111c67
-
Filesize
2KB
MD5b806f12a61a51326e99766caca48fc82
SHA15fc0a7688a96afc6bd255a6b811053748046e3b3
SHA25683880769520452e290017f020bd6fda4ad8f9b19840808c5fa51c00820ca7993
SHA5126e92e5e61a4f2194dd8f4ea6d446c21648600d17effab641679b6202ef480992967c90bcbface7c4ca5a9d8d10c8217e697e7b8db8faf4fb425a372262b85fe5
-
Filesize
2KB
MD5ee96706a8861aec74fde6ff410b65b8a
SHA162ad565e837e5b8f3515c89d95298a4df58a89c1
SHA256a66cc3397f5fa4b98e2f79e3e6ff30c3f2b480a93cbf074f6307dde89fc94ce7
SHA5123724d4fa02075b22aabba1d0b20693e6e34017860b77197b5827b6427b3de4feffe87f4867fb7254b5f5bea51f9f41a5d839fa08c4be2b7049812531c45eeff7
-
Filesize
703B
MD5bfd45641f7431fc66502ba8808401b14
SHA18e238bbf3741fdfc370ffffb9394e947f2c94a23
SHA2560ae13feaedc9ec4c2c93ace03434b792fe0f3f50007636cdcfa3cea2034a0945
SHA5127ab48ee7e580b472dcbf505fa8fc0e51c41ddb707ab34a87078ca734ee9d7b025999036fad63ab8a3017dfebb6b66d95bf0f1710e3301517a951dad667a8da8e
-
Filesize
6KB
MD5816792d50d90066a96fe5ab9f5063a80
SHA1a5defa688c75252101d40f876c80ca4d34493ab9
SHA2566ca3e299faa847cb6ef7d897d5843bb050295321504978f5e9b3516550f08ed4
SHA512b8c08efb4a2c1402ff52e3b585c5a7bc3ab48ad58044de0b7015669462faca3e0833f455178f3bd408680fb3e1752fb930cebe8bcb1f400402795ba2243ac0ce
-
Filesize
15KB
MD5400fa3e34343b1766ddc490e570281dd
SHA10eb794e4b928cf4fe69273923107b7bb635cf556
SHA25626c11d19baee1ee04eb1b385822d7f61b044ba5532cce8b4795fcc4976dd30d6
SHA512ed815502a1997fa4d2ba107107859aa0a4857787fa994bcc39cd41b0fc6e87b9a93073b7aede48807e2e583d0deb70339c072d02b5c019dc450540edc76e960d
-
Filesize
261KB
MD50fe07c8001cbad45eb620339036db658
SHA1d5664611e78eee48048fc3a669dd0f0428b781cd
SHA256edf6b120b7d9c4af08c1ef8cd5615f3b983fbe74d4854fc6637242a783930d09
SHA5121f7cdb228aad05eb87a74e557ca42d15253b71f7d27c314cfcb9e89cc31368d99d196f33d3754c34d4eaf9cd29fda70c646d92c4ba1ea5ce5ba6974deae61bc2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd