Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
08/04/2024, 23:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe
Resource
win11-20240221-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe
- Size 1.1MB
- Sample240408-3d2g6aac41
- SHA256 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7
- MD5 410bd84d5131c67d896d41b749eb2ff8
- SHA1 2ea03c7dcd665cda8ab5a15fb2e3e9443ee9f97c
- SHA512 a4daf47f080681b2c3bcbb44fac4ee45cb1b76eb89cee78666c9e474aa4e6b8bf32304796a43e9dfb553c1c403fd0fed62e0773e8b39ec1a36f897743121e7e0
- SSDEEP 24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8a3N2+b+HdiJUt:1TvC/MTQYxsWR7a3N2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133570922885184535" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2724 chrome.exe 2724 chrome.exe 3236 chrome.exe 3236 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe Token: SeShutdownPrivilege 2724 chrome.exe Token: SeCreatePagefilePrivilege 2724 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 2724 chrome.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 2724 chrome.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3572 wrote to memory of 2724 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 76 PID 3572 wrote to memory of 2724 3572 8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe 76 PID 2724 wrote to memory of 4684 2724 chrome.exe 79 PID 2724 wrote to memory of 4684 2724 chrome.exe 79 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4688 2724 chrome.exe 81 PID 2724 wrote to memory of 4512 2724 chrome.exe 82 PID 2724 wrote to memory of 4512 2724 chrome.exe 82 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83 PID 2724 wrote to memory of 2228 2724 chrome.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe"C:\Users\Admin\AppData\Local\Temp\8e61165fdc83d9920314de566c9ee9ea10adde433d3a34bb166dfeea07610dd7.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa8df59758,0x7ffa8df59768,0x7ffa8df597783⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1396 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:23⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:83⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:83⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:13⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:13⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4544 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:13⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:83⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:83⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4692 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:83⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=876 --field-trial-handle=1856,i,16059543184149251191,18310262638693625900,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 26e1e5964076ea9e8403a15b8d33885cc90e3f19e802b92281e125136957f9e3
- MD5 83519e52e122363a09f713c722468068
- SHA1 ba4616b3223f277d06b30b7c89b95f7cf4d7cd67
- SHA512 949d99d88b4e143ceb93b125e7f98dc8783ce070532094e6a20a0b03cbd5791dbf6a0b98694320e3fa9718e3ab3822720ab1343461faf5a1d65c34922fa84640
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 906fe8080cdd7d313026e2088c30753ef758920a8af8e40f56b98896b96a5058
- MD5 e16a7d9a0dcfc93c4872aa57d107fbf4
- SHA1 188393d7589d4e311be337fa811984db37151303
- SHA512 6e691ead6b792bf5ec831bdc3d78420f0d715cd0759014c268a9cf82ed2bc05a9a11acd42a8957a92ec9258386a78fe4c9eb498cfeaf9fa673e64111c539aa1e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 247b497202c9ea493e95555cc7ad10299d8e7a7a44ed90a6145170583e4cc63f
- MD5 f9bb466708cc91e1a68d586137c1f436
- SHA1 520e70dd215fb5e87d2dd61698d3271b1a556775
- SHA512 4060b83354adb4b694a4ad9a48d2584b7d1c823b4c0d5571684eeaac2db77b82a7a49c0c0a730796a800eccdcfc54df7470f59668662752173efedd982cd884e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 707B
- SHA256 0d713af2b1447f97a18bb4d5d4d5c062c1bae1605d5fc5536bec7f90bf1863fb
- MD5 62926f3051c8a263ef7f2fabec01d1fb
- SHA1 c182012f9ddb5d87af19a65588bce6a7c009a689
- SHA512 96b93efa5d57ecf5c819a5ff0a5e53b860133f8188d0df43e52068096480edda4c8f300746cc2fe6b19963e449a1aecff07e4da7a720b4f13f7cfc217db30663
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 3a3c5dba5662fcdfcef959ac8b9973eded1adccd173908477c5970a12882a2bb
- MD5 dbc5fbdab55f730e68ebc0ed38ab6cc8
- SHA1 0fc3b9c061a5ea70dd260b9cd3a27b04450e6070
- SHA512 a1dc8c28ab08375a6c341b1288049f23ac6ee5d34eb582f9b49052da3956ae23d7f7726e5e94797d2bc134f9c00df9006e5d8326fd0b0d575f8a2316fb525411
- SSDEEP 96:/k+kjJ6XA0HXKIJS8iZeKsok+y7Di+6MsmdeX8kO15OTZ4vjVhYtjEsXt0/cg2VI:/dkF6Q03W8fp+yy+FFkOzotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 d81db58db02e35c32f586d1bd948c57e9c82177d0fa597a84a628a1f44bbf4ee
- MD5 4cb82a0b407e0dca7ff445b1b4326196
- SHA1 6009c86d0952b8f9dac2c9ab63e20248c4c9198a
- SHA512 86263a3ad6351bf2fa0350882abb1eb1de19d3f1789ff3fe68bfc01ff12e6ed0a8835840164c7e19f16f69be0d1fe9512fba0d1c69a5837a1860d7d813e82de4
- SSDEEP 384:XyLPLe2XD1kXqKf/pUZNCgVLH2HfkyrUwHGxbsoxA:iLPLPD1kXqKf/pUZNCgVLH2HfFrU0Gty
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 261KB
- SHA256 21af010ea8e222e5899445bb1da015663e5658a0695747566d1fb6687e573565
- MD5 6f9d69b4bbdf38377069e194f0e7a513
- SHA1 ca4055e27a5507913f3b3a5dfd39f3d07d6b153f
- SHA512 80dc5489b1e11bc10119df353ae40062ad12b120f6c056dc130e0273036790b82741bb97688f31c8b8ae7a7b6e8ebbe6f9fd460b73f8151afe53ca6ba52cd7d5
- SSDEEP 6144:Ch0pjWZN8xXapaFTwJ6d7Yj3Ua9jHThM8fNHK9K5z:vpjWZ+dT0IsbUYHTqwNqo5z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512