Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/04/2024, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
MineNightSetup.html
Resource
win10-20240404-en
General
-
Target
MineNightSetup.html
-
Size
310KB
-
MD5
86363e3ee5cb78ed2435fa6e2c051463
-
SHA1
903b7322cd80265c93d29315a86f8b1cd3719d27
-
SHA256
ed504b4f139c0b4830474a57854cf6e8c8f54334f2b020085a36d545b45fb3d2
-
SHA512
bc1e0cdf1300d2f7ed869e339937356f96847d491deca8817b17e79693610741c82738585ea4a485c5b7e86ec08b5efd6af045be283b03d4b188464a04408540
-
SSDEEP
3072:KiJgAkHnjPIQ6KSEX/pH4PaW+LN7DxRLlzglK0YK4:fgAkHnjPIQBSExYPCN7jB0YK4
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589813030942209" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 3748 chrome.exe 3748 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 4672 4240 chrome.exe 72 PID 4240 wrote to memory of 4672 4240 chrome.exe 72 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 4060 4240 chrome.exe 74 PID 4240 wrote to memory of 1292 4240 chrome.exe 75 PID 4240 wrote to memory of 1292 4240 chrome.exe 75 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76 PID 4240 wrote to memory of 3520 4240 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MineNightSetup.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe3c0a9758,0x7ffe3c0a9768,0x7ffe3c0a97782⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:22⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4808 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3084 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4980 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5056 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3052 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4860 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5100 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5956 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6564 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6760 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6884 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6356 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7228 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6892 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6716 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6600 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=7376 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6568 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5864 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6052 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6184 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6168 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=7896 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7904 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6740 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:82⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4320 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=768 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7656 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6104 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7056 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6168 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7844 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=7888 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8248 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=4824 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=1620 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=7772 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8444 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=8184 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:12⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3808 --field-trial-handle=1820,i,11970148013097504408,14670169065817249903,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5675cb66bf44402292c9f513e881cfb31
SHA1d386b8b985974dbcc333a5b4c4d6b249a7ba649a
SHA256d34eda46ca4c4455ea9ab8434b3306eabebe0fe1eb4742d10d0d7e3294e31025
SHA5129891cdfc97ffdb629392f22423daa9026265bf38db0728263a3ce41e2357a25e50577cf81ca79570915dd0fe4e43facdfd97b3165e3fdd80b4d6d3c910aa4c06
-
Filesize
21KB
MD5660c3b546f2a131de50b69b91f26c636
SHA170f80e7f10e1dd9180efe191ce92d28296ec9035
SHA256fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9
SHA5126be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
73KB
MD5288e237007f65b0d88cca0a2c70e2688
SHA1d858c9c8b26baeb4f71e4e276b595036a226352b
SHA25663eb3036f3ad1840f922f83275f9203bfb08868977ebca1ead7eb55122a40754
SHA51263bfcee327231285c52df7cedde5be98e0cd5823b2d9e2558df851ded7f70f33a7b875e591603d774020cc6ad55d45ba376b2a51f57b31942c8973ad7ae9274a
-
Filesize
1KB
MD52ac5c477735913b9332d7970a5a6c6a8
SHA1eb8d1711030f551aea59d4f14cbb6d7dd2da4447
SHA256d7c42fbe6ddd0e618903774261cc313590729bfc05d02e4f829fadcc10a1395e
SHA512b7da05b8c22b11db64c7d281034ce19116254a34e1bfb259f4a7789d4ac6ca73624646cdcad4dbfaf1c20bf1d965f4a061ab54b9b799c6bb59fea459b324baad
-
Filesize
1KB
MD5128623546801fcffad8ac72629154c0e
SHA10136a99ba82c9b7a1c1c7b7e3b09ecc8bae3e39f
SHA2564710adf0d7c7bf854b504e8415b82f9c4f66bfe67db26e8c649ba925bb652f96
SHA512bbb131a906aae930fc322b24dd98fa29acfec4f339c49110e1bc9738e2661dd412beb2d45ee5d2906afb4bbc82cc402084d1d6bf8f1fa97830dfd21c568aa099
-
Filesize
14KB
MD50c354c367aa3ca406989b65210ea7988
SHA1d448f3c213352bdcc41fc30247e67d20908ff677
SHA25646af05d0933a20efc0b8219a0d554b573fe2084c2242367a12aa5329dc722f20
SHA512644b124ce3251329cafc310832ef617b392f3af9a5e0a4e6d4fe36e400e7694eda741a6eadac20721288573fa0c1eb0e1cf7ffc8e047f249094690a793ac262f
-
Filesize
3KB
MD51519d018f0cf333a88cb159c2bd6d593
SHA18ca021c48a2129a1a60ec031a1d6516e80894eae
SHA25618c285e3997e2a65ec72eef8ac68dbcc6e7541caee7ec2b53a1b391c11a0d621
SHA5128d1815d7c2b23f17e557d4cb2328be95851fed6737545c11540bb544d3c226409a197073be344713b9492b56bdee6d11045da2ba97acdfd8dab7c2ca62e2cea7
-
Filesize
4KB
MD58031fd288c80e8d28d7ea142b68448e4
SHA176f2ed95859b254333987d2f5cb0615263436b16
SHA2564d1f6204bdd983cfce617d1f66165e11001538af98b1cf32cee563d40b193b3f
SHA5124c2864d66ac726652d0777d3faa8ba3cc327574f3c1c99ba21fb073d2f4f0c49888c4f3c6de54f2020557ca583b381b6a5368dd3ed33f110bd63810ded314801
-
Filesize
3KB
MD52f0dc13500fbff59f0da03024490d2e1
SHA1ddb2406559402bed31ca4f5b02495b0b69a796af
SHA256d5f25aeb3b4369dc285d3ddac4fff0e48cfaeecd927012329cda3eb23441ce80
SHA5123b3ec8acd9337313f982e8c23ffdef6538331ed871764a930d7320838fe896a465972faf91cd10b9d36171905109cb96a32aeff7b810e339b048ed20929fd0d5
-
Filesize
1KB
MD56647344283c7467cb67f8007d4483e3c
SHA1cad657fd8cce1082dd4799891ebd156e4592fb31
SHA256d8ebb5ebb6def84ad6b1407de6a51236009e967b26b2a461120a658c32343302
SHA51238d6787b789dc38dcb2155863b9bf53552682212b0ac39167b88b0d1605fc5796f7c8feb6bfd06bdfcebd8d4233d0b4b44256048f18a5837436aa65feda870df
-
Filesize
5KB
MD5d0f550ab423d74b3b63d4e775ca323ad
SHA1a8a93acfd0c13c3799ce1417abe5ef4b7d6a1670
SHA25625c5b6fd0cecbba561e950809df2fee099234e028964f2635edb8bba8bb0b189
SHA512858b495aab05ab884fe4dbb7911e8622dad4484105b2fdecabe889426791458d10b0e84d47c81f5caa50a98dd7d03907860bde655f828527cdf0e62eb1a24612
-
Filesize
6KB
MD5834044017977a5e5669e485b955830a1
SHA18d1d65c2c15dc5e649e7460f2fb3460223e5723c
SHA2567774d639866b1e7a1dda7747e2cf910a8dabc9b98b1e2d30cf307b9bda4ce0b2
SHA512a5955c61206dad3a396b610621900b1e087e14c521a54020559f167b268887f03f22f012bd1a92e85e0bb68b430e4c1b67658dfb0ede82bdde9bdf5331ab3491
-
Filesize
6KB
MD51eb47b0ab0f0131d327e239b2ae9f850
SHA126a5320c7ea05b49b9681ad2697d9590098e55fe
SHA2564d351e838a3b2b846b802adde37019873d672ca64481b3b6b894e565fa8173bc
SHA51293cf987adc1a1935acebf08de64a3058ef9506d78c75eaad61a2969d375e887f08eb184cf34fca47b76d98b5850f09f6c9a2e9534fd94db8a7a66871f2fbef00
-
Filesize
136KB
MD5517d6ec1e4171cdb2d21976eeee86b86
SHA1026ca73786dbfae30f4a49c8fbf4eb77934c4a8f
SHA256962a74baee321e32310f598b1187b5d8bbe43fd3ff03b76e316674d369a12cab
SHA512a5c886ce2e40a8672b6b537953ac1d9cdba769e9efd456c0e385111b2bef0a02445a50f72b18c38ec0723b53392442c9fef865915a834f84ecaff42717fc9f24
-
Filesize
136KB
MD5a90676b350b73ae45f05616b4cf59a6e
SHA1e08f72b2c0eb8cba195799b95d51ed25d3f9f7e7
SHA2565f1b3974467bfcb48808e90a03f9f73f4d175ae613feaf6d45290f8dc5f91b32
SHA512aa399c4d1a78b51bc6b2eb89f02244647d63252adbe46fda5736048fd243b38f43083349ff049da8f31a1094ae51e2b02bee99a72f96e680803ca835355bd24d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd