Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 22:32
Static task
static1
Behavioral task
behavioral1
Sample
PG3DInjector.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PG3DInjector.exe
Resource
win10v2004-20240412-en
General
-
Target
PG3DInjector.exe
-
Size
76.1MB
-
MD5
666d27360a5154c9797e3644f22a4a67
-
SHA1
31b8aa2ef6eb33dbbb2fd1305114c806b854be35
-
SHA256
f4055022c94103087ce5fe4ee8493bc11e6fb9c788134fc732aa9ff5d05cb765
-
SHA512
042e32431b62d45a09b13f94f0699ec1d94b60c88705ca23ccbea9e939010bb99f98df437672694aa19e47a26aeb8f865a60053475b18d833ec6015b263dedbd
-
SSDEEP
393216:lQeufzJiVWHIFrrmsx5lv8QshCe9dlkEBO2/w0XzN2FX7RIMnBZ1IQ0P543WbtZV:l5utHUrrm2DEQshjlYPDA5UUVIa2Q
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 305 raw.githubusercontent.com 307 raw.githubusercontent.com 312 raw.githubusercontent.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580396336394642" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{A60E9658-92C3-439E-AA95-DEAA7FC3FA74} chrome.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3760 PG3DInjector.exe 1540 chrome.exe 1540 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3760 PG3DInjector.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe Token: SeCreatePagefilePrivilege 1540 chrome.exe Token: SeShutdownPrivilege 1540 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe 1540 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 3424 1540 chrome.exe 112 PID 1540 wrote to memory of 3424 1540 chrome.exe 112 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 3740 1540 chrome.exe 113 PID 1540 wrote to memory of 828 1540 chrome.exe 114 PID 1540 wrote to memory of 828 1540 chrome.exe 114 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115 PID 1540 wrote to memory of 2476 1540 chrome.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\PG3DInjector.exe"C:\Users\Admin\AppData\Local\Temp\PG3DInjector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6c06ab58,0x7ffa6c06ab68,0x7ffa6c06ab782⤵PID:3424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:22⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:1116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:5136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:5216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4408 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:5456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:5464
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:5644
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7c3d8ae48,0x7ff7c3d8ae58,0x7ff7c3d8ae683⤵PID:5664
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4156 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:6024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4328 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3096 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:5908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5084 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4884 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:5308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:82⤵
- Modifies registry class
PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5252 --field-trial-handle=1948,i,739076914851272460,13820890501722578724,131072 /prefetch:12⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3292
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x4bc1⤵PID:5548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD524edf43fe24e0e2e7352dbf325da6d4f
SHA126b8244d8366e748da623305c3640f7067c3c22a
SHA25626d41b24cbbeb3c94bcbb52078ba4604564b15244e1f7a519d835a46101a7db9
SHA5129660c8e0aac4c9061c535ffc8058d999b614e891b00bb60de16ba80a4910c79525538875174c7a6cdf430676fdb403ae63be39d2cba81518bb82e48cccf4af64
-
Filesize
790KB
MD5c74d91628b1ad64d84b6eedd9f7c996e
SHA1b88dab7c50a8a65b21cbcc6cec903fd92f04df73
SHA2563458831ddbe1346dae98c2df768c946faa4f5a1f356a64d9028598fac5aff3e4
SHA51251ff90042a939af9dac4e4f7831cf94183feaeda54496911e535fadbc6f1b38f729a16344a6e5fa92bf90280a6b38a5ce7980842a73c4958e2b6d43a9ed2fd16
-
Filesize
33KB
MD529fd127a703ea13ee1d9a4492e447c1d
SHA14550738e0405bae4e39b412dd09f0adcd1a9582e
SHA256e33d4e1b7409ce8d8ba757c8805103527f12536818ff07264b5a65411d62df1c
SHA51242268407a36ee94f9750a1c9bf8195ac7a856972d1a9dc4e7394221d732b1fd397c49b08b90414c053b771223efafb68702fd47e17cd069c175090028cfb9b18
-
Filesize
2KB
MD5813cdeba086d108c0143cf01b9074805
SHA196295de9e2af0cd027c0aeebcdefd72ba62e6aa5
SHA256d400b38ca5afc11ce125af063c7cffe3d3f5f375953d93da2166a433407fb719
SHA512845ac3ac21bebbaa3975d1e3efd1f130155338a52d55f3c358351b1697f7a6f141f1725acc1f5d64600a47779c8006477aba6974bf3befe796b00ff776595655
-
Filesize
4KB
MD5e3695704fcbce4eb253d55eead5b438c
SHA1dd349948116482b5f474237d4e262a1fec7210fd
SHA2562bcb7bd83c87c462a4217ed418783f292fbdc8e87122edfdce7e5c2c22544665
SHA512e9afdabcafb1e188506292697a37e1cdbb89960b430cf21afd386568938c744f2d2cff688c08a184fcb29adcde8da4e48a4d4725d153a2388da2a342d7d0605d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD576fccaaa128de15d419d6b7e2793994b
SHA18416d667a540758029b4ebb25f5a31347294f1b6
SHA2560488eaa1768f606a57965e7ffdc7ab7c4aafc73d0352078367b9791e22aff949
SHA5127b8e2eead77c14d1879189f6fc44a818944b8a28d72e14bed94dcd6877c65e4403a887abb0dbd0888963336f9e5a03a78886125fd57e07cc6af98a06f1b5ef7e
-
Filesize
859B
MD5e4c107b7f3786ee6a82dd8d13bf16f28
SHA1a8ce7caf16076ca694bc7a8b6bf0d23be6396ee7
SHA2561b7a92c4badf4a28a92f57cfab9eb9db81cd71719890d907065fe463eedca9c2
SHA512ed0e29ebf57cf4632779089aa9c72cc97adceb969742aa6c9b6cb011317cee62ca200783aaaf6cf1a4bd6dba1ad0ac56c39cd0f77395129dcd61cdb91fe7d08a
-
Filesize
692B
MD579507c6f9db3e95352dbf8e45b13dd41
SHA172c39167e65f0d81f82c16d1b981a53c517e1be9
SHA256c045a37b67342d33d767c39a131752bd6f66e48f26272ef19393dc9b8ee46795
SHA5129a3881e0692f6660339142c759c65f674ef4b2519843288f720bb2a41e7e8a4d4c604ea93b9a29c69d3a3981deb2ef8856f4700b19fedc150533ac061f52fa05
-
Filesize
1KB
MD5020fc64369a860d9e75c26ecd925aeb3
SHA1425263045d4c251d932240eb238f574a3c8eaf67
SHA25680cec7cea30eab6f9c5b66c688cec708022d607f7da9e4d846639dc71b0203ba
SHA51297c251e0dff465a804fbec1d5987ee1fa7a88e79941785485ace5582dee9d32bb783514771ad5b076f1a39fef2016c6d9d35b865434294504f3843381dba2825
-
Filesize
7KB
MD5ff5de4ac99c69d9c238c011957099664
SHA15a22f83592a173574c83ff2522c639fa3ea48d4c
SHA25620e9be8e0e54529bcb0352cdbaf0e5de687d543b3b48214c3519960ae7908507
SHA512a4885f6433449f8b2d74acafc7d7779c9a29f0a86fa587c187bd7db46266162966f6fdcb69aa375dec704a72d69b7a8e9b4c813b9ab761d723fd027921e5b143
-
Filesize
8KB
MD50963fef2a012b9a8505bf5aaf564d00c
SHA1cb240e354fbd823034691fffc9a90a44506beec3
SHA256fc9f36c5335a83b1f9fd93fea77fc05fd11759f90cb8d69e8e12ad62102b7d1c
SHA5122e328f5874052a9d9b8c45a0ff3ad79f0cdc365c661bebd5e583687a3c1ebd3f120717232e795d69e650194d440ab0aade8a72cb6fd3eb5c78b5646387001dc2
-
Filesize
8KB
MD5ed2e4f66a1ec2fa2520bfa6de001afe1
SHA19fc1f6aad10e84c1dd9f76bba52562cbdd347894
SHA25603dd3240cb5458ab89a2d2f702b2b96b6633303fcdb46abcedf9238be64403a2
SHA512918fe048bc54658bbc82d3a86923564fb6456fc750961668c0bf881c73c0a4202184183c5c3f9f5ae67a373871fad5e6a8c6de2852bab5d56cec10f70d4e5db5
-
Filesize
6KB
MD59e99ca9c07d314f0e1aa9a2046b5854f
SHA1caa49ae66cbb27ad39af70116646e85794a4d460
SHA2564e55d603ff754f09edd04b41ada4c3f35e63644b94e5190c0b50f3022ae33e75
SHA5122bb30dd4090c52b1dca55f9a59b9c38da4f7ce0c6ea8921c408f05492229b4240d83f29e650a9984653b1a1a1ab5959efd2c87158f4192e973b43e097045cba4
-
Filesize
16KB
MD588f32205634f836def7451dd5cea9d4d
SHA18771bf8ef4ee9bf5dde795e5cd43fd5e6e64b2f2
SHA25652a679d18dd782a82c8d7896819a6c2ac242f65ee2d9b3ef27a3b6235bd238c1
SHA5126230018ea906bee09245b7f4faf1da030fc03c3bf257554951329736f4897df3f4b274a59941714c9ab30dad34fe85d128dff01ccbb0b8f4bc81361e345f0ff7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\61ab009c-be80-45c7-bdaf-228cfe0defd0\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\61ab009c-be80-45c7-bdaf-228cfe0defd0\index-dir\the-real-index
Filesize624B
MD5ee5ec732ece844b0df9f73b4b9a450c4
SHA1f35de63c6230d9d4909d62468ca21a8646aa9466
SHA256058444585d787e0125daec3b4eed729250cbc3f23c1495f04ff0e69b2a335271
SHA5125aaf5d6469f450df6cd4c2400d8bbf9a15e55c5df0f687bb257b1e20aa371121eae793cf33aba430356a4cf7a51bfa6bbd28b672fa5191279344d231d506fc99
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\61ab009c-be80-45c7-bdaf-228cfe0defd0\index-dir\the-real-index~RFe58b580.TMP
Filesize48B
MD5e79a66df614f1c651128c56445ad0c2b
SHA1c766184f56ceb69b7d1f8fbfbae4bfa1542d6b8a
SHA2562e37ba2895336b9eabdeb1208705eba038866d82c11cc30ecd62830167e6df03
SHA5121d032e2553746d3c96dca0675ee5d0f2ec174a4943d53a9f1d1406247845d2059c8bc6e0b01ce57d3274fb27fc83513a088f960485316eef12e70f9438650f42
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f6f3561d-754e-49bb-a1be-8672ae53bd9a\index-dir\the-real-index
Filesize2KB
MD5e8b420b9bd6c7fa5e12bd9621d1ff248
SHA1858a66973340b0288310554fbb5dbec193fda12d
SHA25685a7345841d909f36b18506f6ca06d651b325209f126de288a221addb3b40962
SHA512f81f83f3692a15aa4d41da04017b3081ac6a4e9fd3fe42d6466ce3fb41157531165aa2480a8221aba123975cb08fc871f9f799724eb5b602f419a515bc52a292
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f6f3561d-754e-49bb-a1be-8672ae53bd9a\index-dir\the-real-index~RFe58bc85.TMP
Filesize48B
MD5566524fdfa8ec203b2a3ad710c902ada
SHA1d64b871ac255ddb5feff6c75dbcd25fa0a7bf4e2
SHA256390eaee5e8457ea106c55254c7d687d278a49742977425c3fb2130b77b5e0fbc
SHA512e743eb23066d84c254cf4319311a57346a822246ee62f21bf3697612ee6d388e93d140c96e93ebfccd4510206c291ea5e22004d7c174fa05d5a289a52d476ed5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize56B
MD5ae1bccd6831ebfe5ad03b482ee266e4f
SHA101f4179f48f1af383b275d7ee338dd160b6f558a
SHA2561b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize119B
MD5e704913b3610a48f8ca6ad52c674b637
SHA1832ac7819eeef49075d99de16a11d3c9e3806774
SHA2562eeffc9d79cfdcf20dd623d8958ff293b19d746b0995d1ebc058f35be6df3e5f
SHA512842a053021bb9855ee6056b29a088bab6a2acdc9d6f0f38c17313380a9d550a1745d5a783a573860db555324f762657772a1814ac9a9a23e0bd53b3cc293a65b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize176B
MD57741b4149ab80ff9ce252b89a83d2b20
SHA14471a0d997e458823ee84d79b993ecd9d52c3115
SHA25656b9552e708aed185f75553d4d968bee9c6c0b45d630cb5726b5ccafef601242
SHA51230a9da094e9c0c7c89cea42cfb4c7868b9102b22f9e429f912d723f30a3e876bee0776107813414dd4f13837fcfd8ca9fb011807e8203e30477d44baf140d123
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize185B
MD58f98d308a1bb50f7a2117d38ce3b324a
SHA11912e7d5aa78c9fc7c5d5bd17975655e6e0a869b
SHA256aa4ae5e0c7f688e31c60e35e25e17e04b78f8b91fcdf2ccba6dfee6235ad3450
SHA5120a2d4c00a5cf78d85e4e06ced506ed799df45e4878476b8c8d42fdf46f20a90fb6c6e4e6713d9816cd56f8063a5167699e0e01fe84d3109d16727419ae35632b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize112B
MD576eb3ffcade83510dfc5d3c9c47d5f0d
SHA12fd67fe88773a79f21b7eae0aaae983b343298c1
SHA2564e8781dfb26fe14f27ee849b6c488ae0abc071120dbf07084662576d235a7b79
SHA51237730657671916f2faee49f12a6bc3390adfc3a19398d7e524a16c5ea0339b61c6abbd648702e2680b8a11d1495d2d210771db0e4ca1553ba2e621805d0e7c1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize183B
MD570d7359c2e9a0f961484d5084b20fcaf
SHA1d8464b75afab2d5810974aa8e88277c18ffd42c5
SHA256ffc0b6972cc7041d17eb183ca47dfdcc42d3f5e32eec1b6d46309870d00eb792
SHA512d5ad62cc88c6a7b258b6a88e2a2619611debd7b09c07c4b37919adfb4080d92d5e40d532071a9d82ccc8d81d1421f64eae5dd30335f714bcc054028c6a92c618
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe583dee.TMP
Filesize120B
MD5852118c0d7e9b5cd87393ece6f100fbc
SHA135e8593fe1d8c11ff3a33b26a62a512245248f82
SHA256d378560bdda636bd6385287881777aa9bbba971875750824b2e19d2e8dc92824
SHA5127ee15a2ab679cd1ebe326ab0cd120004c5f954bb2f840131fb533c26ad1dae93cdada69723776a93302496509f8893d547a8ea3623e87250326424d9edc5ffc8
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5f8fc51b9fd54cd6e39b6c3b806d2aede
SHA1462fcedb3f2dfa2992742555b88b6ffe804af144
SHA2560655e1959b3f4678ba5e1699acdd8aef4526ef33856d2557678b3730eb372041
SHA51271783c42cb7fcaebd3d816ddf46851ec16eed896029edd30a54ce08c70fd825158b00e0a1909ff7eef49af7c526b57ae2471c27882df9204e414e81d6e68d8a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a766.TMP
Filesize48B
MD5b9726f12464e35133609eef556fdb4c8
SHA1cb180688a9ee2cb758b2b186837ddfd22880ff87
SHA2566bb55ec075ca6abd22610f7e934fa1f4071845779747ea2491e338aa8543723f
SHA51209912bdbf5907a80fb47873fa8001d280bab8aea0c753cbe917fb0abf978cdc1a22dad74af6c32a7ae3f72db907252eabc813ce50114713e89b54a81b98bb669
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1540_1605417292\Shortcuts Menu Icons\Monochrome\0\512.png
Filesize2KB
MD512a429f9782bcff446dc1089b68d44ee
SHA1e41e5a1a4f2950a7f2da8be77ca26a66da7093b9
SHA256e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37
SHA5121da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1540_1605417292\Shortcuts Menu Icons\Monochrome\1\512.png
Filesize10KB
MD57f57c509f12aaae2c269646db7fde6e8
SHA1969d8c0e3d9140f843f36ccf2974b112ad7afc07
SHA2561d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f
SHA5123503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1540_659905840\Icons Monochrome\16.png
Filesize216B
MD5a4fd4f5953721f7f3a5b4bfd58922efe
SHA1f3abed41d764efbd26bacf84c42bd8098a14c5cb
SHA256c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3
SHA5127fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691
-
Filesize
252KB
MD52f0de3a80c623f3eab581c5b1d2f7593
SHA12ca404a1524fbeef3b2e2e3336c7bc53140de130
SHA2566d93968a44569dd06e58b47f57ed21bc41e6e1d792d3651c82e2b14abfad9efd
SHA51226ba06c9e04d499979506ca08f2231c708816d51310fb331cf0c323ebee9021b34770d33e28c359c9a3500f94285d99dba34fd091f0d15594324378e3c6ae17d
-
Filesize
252KB
MD54a05b1be8a28b314dcd2b5d65acae134
SHA127a13a113e009041511a296227558f300138094c
SHA25645f6075f5a4eff04804d5fc44601b2967764eb436ae7a2f23e7081e8290656b0
SHA512824606af9783dd170c222ade44b2fe2dcc0b5031295e37e3173105fef8d2363ade4dfdbd448a1b5bc5fd47d3442eaa3e7c58e8bc472cbbb8439d204c76471126
-
Filesize
89KB
MD518fe50ee2a956031f107e0a7e6b30c28
SHA1b99478787d7ed538d15c2fee6b4e514674e06c02
SHA25619382b41329f14a7c543e11a0b3a5b95a15c2a5533bef1f60252a90b8355fa6f
SHA512389181d05043c888277c257ede7718856517930462e59d2e972b3abd58d63ca017304fbad60a39e195b2f57607ab1c0ed5d2125f97689245c38b8fe8c22b1688
-
Filesize
88KB
MD5979f08c1a59a894b5587ca1f7f21c679
SHA16d38f3834fd59a357ca4105b372db9b7f86b9396
SHA2564e3ba043a9181002c7ff0f24543efe169c347c4bc87ba2402fbc5d568dbca37c
SHA512fb398f9d9a7a6f67a4e57901eda11a950d8aba9984d0d105206f5ba932018bc58f8897a05aeb1b8e600ea54a62ddf23be92c9426ec4bcea1f895d3fe4546e6f0