Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/05/2024, 06:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe
Resource
win11-20240426-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe
-
Size
1.1MB
-
MD5
69141d224b6e4ec68ac90d9852dead95
-
SHA1
4533a4728b42f92d2a5b108dd32db24e1b0d22df
-
SHA256
dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954
-
SHA512
ef0797696638e713c9e2c02ae6891cd0d6db96438f84dc232b35e60f06019249b89bec55fbb9b0c69086672ef2edcc4c65b08ef463620fcb6fa45dbd07c5cfbc
-
SSDEEP
24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aup2+b+HdiJUX:VTvC/MTQYxsWR7aup2+b+HoJU
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133591911411183305" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3588 chrome.exe 3588 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 3856 chrome.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3856 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 80 PID 2912 wrote to memory of 3856 2912 dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe 80 PID 3856 wrote to memory of 4480 3856 chrome.exe 83 PID 3856 wrote to memory of 4480 3856 chrome.exe 83 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 4844 3856 chrome.exe 84 PID 3856 wrote to memory of 3272 3856 chrome.exe 85 PID 3856 wrote to memory of 3272 3856 chrome.exe 85 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86 PID 3856 wrote to memory of 2416 3856 chrome.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe"C:\Users\Admin\AppData\Local\Temp\dc27cafd3f0c4e9d1aaaff8e92acdc81c6062834bdc8fd0ac6525f2920fe1954.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff4250ab58,0x7fff4250ab68,0x7fff4250ab783⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:23⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:83⤵PID:3272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:83⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:13⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:13⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4216 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:13⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:83⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:83⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4220 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:83⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1808,i,10624352623469909169,243755207886538301,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5b0d8e68a1f0a43190b72c56fe4e5e1ce
SHA1460a635696474fcd55de79919f3ca4ca3a2fb447
SHA25634e87279c2da1b99c9ecec476a39001214325c11afdb6bc1fd64fcae75ae2563
SHA512cf502a4f1b74aa443856bf902102c9a9afba6e7b497024a51c9b092b158f3178b6254ea2864a2049aaa9020176be8171e9ad2b3a892fb239b8a026c72b066175
-
Filesize
2KB
MD5616f7db4773594232bf9ba40684f308d
SHA1e924ea9b97f3dc838553e87a9cade981eb091127
SHA256acc2621b91e6977a3bc6a57878a23dc4fb1ef66b4b8a1c72c82c719fc222ae65
SHA5125aa129d6dfa9368d0e07d9df6dd7b03d300751716dced9329f66beab0790041df0c2bfb20a5cec82786957efea85469dc88c40d9ddb70d84e965adfd81b31907
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
692B
MD54b03aa9fbfec8a06fa517eadf01a81a4
SHA1bfeef5e484bf20b48c30afcc8925942db212d3b8
SHA256f10e49fad7b51f12b7de9fff0b00a99d61bd60b61c7eacd2a46d2b178a28548f
SHA512c1203d23056f46bdd44a7755c86a19464750c8e33ea5f35a0701bd94d5f979b59eb7b3552dd3a9762a15e61f717d4b077394b4f17fd66db280030bfd5fc4115f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c8dcaeac-8a29-40bc-b6a9-3aed7951346a.tmp
Filesize2KB
MD56cca64503d13f3529140669d8c626cb4
SHA10ece24441b7f12a103a6251a5982dcd65c881a57
SHA256cd8a2ab296cdc72c9b33869539ca35c9786c4d67e3eb36f904e5f0490002573e
SHA512279de1f733742098c27427a7a0bf91fba2d9b9e0bcb00515a5576100447ac4daae024bb28208546e63088a5b8459054f94e898b5323a0f56d7450e24a00f1820
-
Filesize
7KB
MD5edef17627ce508058aacf5bc73b748eb
SHA1d5aa8fc6b8b6a27760a49362ab99f31a4330d922
SHA2565de0530be11a761d2d38729d2ea713f3ec18baee7da6337ae698929635855226
SHA512a3b120f58afb4d5e54756f43f02288962da41857049f76805dbaa9922cdf7974f8a7e010fa91d1dd908ed310ef18b792f5d399b11f222a0180fc949498829ad7
-
Filesize
16KB
MD503f2d4ebac79b2a7937b51d733ddbe5a
SHA13fc846e79aa6a355973225a4e1d8ba4494597955
SHA256a20d4c9c698618810b14052def8f9988ab175e72d3235fccd9b03ca072ce0975
SHA512d88a65dce131f4e85200544c72e4a744467ce88b1176b85b200ee41c8b5e941a70f45266dd72a4b208df1d565c10993fc3e064379c9e2367e2627162c2974e08
-
Filesize
255KB
MD5c429ea11919b6404060ebd2deea838f9
SHA1f06770a620ef539ec78ce29a5dca45e60071cacc
SHA256ab8abaa8e5f90be4ae6bd800d2c32e076630732356e85bf69e5278694720f6e8
SHA512eea81b64d012dbe451d3bb33e2260b40c21f4b433dc6fa6ff695feec2e23ca3e3845c3908044d3c168b04b92783ee485c4d02c9d8c99148ea6e493762d9f57c2