Analysis
-
max time kernel
60s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 14:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://snprod-aps1.s3.ap-south-1.amazonaws.com/ap-south-1/cs1262612/1715756599376/15052024_env-fail.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA4U6DPBCPBOYQHOWG/20240515/ap-south-1/s3/aws4_request&X-Amz-Date=20240515T110117Z&X-Amz-Expires=900&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEDsaCXVzLWVhc3QtMiJHMEUCIQCozl+OV84akcBvgUI/CVderXCNrxjdh5t0hl4rM+higQIgfXzrvOD3U0Ishjc+dtOF3sUMDngBHDax/ScFvYcxy78qzQQIpP//////////ARACGgw4Njk2MDM5MzY0MTQiDELfKL8wobVsgfWhESqhBGmPj1OBNk04oWmSNm1lxOtCieimakGvHF9aBA17R2LaUDGVMmMsrumfptK8GrIwqugIA0EJ8Kb2eBWDKoXLvpPVOdVHn6neOe6WUWTDFrO4mUHrRV3zfETaEcIaCof8fz/RPWtBMenl9iS+qQPh628j3j1qREpgjwRrnjSq5+lB3Wgcc/JId++pwRks48oCVyc01son35b/zBMuwqDEg0vp4oG9eoB0o9x5S6rvS0yizUaKNXh2tQeHm7/4HR7i9zkM1EzRG56eKAojJsKBQYunn8C/SKiJMhMRyEAqREcZtJYvydLywtLQVe9P8MQ3bDqnYmBsWRx4s3PBnMaXLFHuqFAal12PD0R59LX/hoBKbTMmLP1bekvZImSjVEw1UzzL0SKeHtHmcGb+xt0eUiNwcKpEKrDGdqNBd9ph9vXeg1Zvc8Vz6ILi2VjN9XWB2y8uuJWrLM3g36k8GqmmAA4TB5pwNmf20HkHrXRvlJGawUFxCtDvg5Dox0Lp21EtePG8OwCwVWfE80+pS+Bvv31Ncqu1b54qdfH/h+VP1epOYzcXUvD7/UcWK4Pi/2MJjHk6NalAuzBAhsb+keJNUNFxqvVhG1t3WAqugGpcJRYe6oskfQVeIQ/57kr2Xp3xOxtq0E2qHgsl5uIvKzx1S4+5SYNvwVpFzSW0TXg9F6wMRpvtfef6QKJPNJbuBMQhrH9tmEInW7HKpD3Rj0Rxigb/MP2rkrIGOoUChb+4Ww/8y4SDg55R7B+gxNZICgqx3VRZyGdLyJnw3hYcBt1LucdclfmD59MPcxSl3e2J1/gE53Ba6Hf/C1gjm4OsF+u/CDXok8peRL04r04B1LYEjJ0hCPZfXQtTfQSmcAn7ZSAMoLxUMYkiUp1VJHAIzioWYeqlUZVk5075RzuNeWgE2M+enkV90AwSq3DoVlNq1W9X6Al97yYSY7iTNXMLR/dcI8WFIFu+Q6TeFdL0msd92hUGXhHvhoUmfS1ks03hmo1KFrp9224x2lQQev7tG21dYR8odqpWPX+sjEzcQC/qUuV3SASingwa+nepHZ/fP2zK68u54fE3mBeUVvWVMl+U&X-Amz-Signature=5725e03f0d1aaa81d0f851134ea67ca665bc9e0da705fac1cd01b30e88cf1fac&X-Amz-SignedHeaders=host
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
http://snprod-aps1.s3.ap-south-1.amazonaws.com/ap-south-1/cs1262612/1715756599376/15052024_env-fail.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA4U6DPBCPBOYQHOWG/20240515/ap-south-1/s3/aws4_request&X-Amz-Date=20240515T110117Z&X-Amz-Expires=900&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEDsaCXVzLWVhc3QtMiJHMEUCIQCozl+OV84akcBvgUI/CVderXCNrxjdh5t0hl4rM+higQIgfXzrvOD3U0Ishjc+dtOF3sUMDngBHDax/ScFvYcxy78qzQQIpP//////////ARACGgw4Njk2MDM5MzY0MTQiDELfKL8wobVsgfWhESqhBGmPj1OBNk04oWmSNm1lxOtCieimakGvHF9aBA17R2LaUDGVMmMsrumfptK8GrIwqugIA0EJ8Kb2eBWDKoXLvpPVOdVHn6neOe6WUWTDFrO4mUHrRV3zfETaEcIaCof8fz/RPWtBMenl9iS+qQPh628j3j1qREpgjwRrnjSq5+lB3Wgcc/JId++pwRks48oCVyc01son35b/zBMuwqDEg0vp4oG9eoB0o9x5S6rvS0yizUaKNXh2tQeHm7/4HR7i9zkM1EzRG56eKAojJsKBQYunn8C/SKiJMhMRyEAqREcZtJYvydLywtLQVe9P8MQ3bDqnYmBsWRx4s3PBnMaXLFHuqFAal12PD0R59LX/hoBKbTMmLP1bekvZImSjVEw1UzzL0SKeHtHmcGb+xt0eUiNwcKpEKrDGdqNBd9ph9vXeg1Zvc8Vz6ILi2VjN9XWB2y8uuJWrLM3g36k8GqmmAA4TB5pwNmf20HkHrXRvlJGawUFxCtDvg5Dox0Lp21EtePG8OwCwVWfE80+pS+Bvv31Ncqu1b54qdfH/h+VP1epOYzcXUvD7/UcWK4Pi/2MJjHk6NalAuzBAhsb+keJNUNFxqvVhG1t3WAqugGpcJRYe6oskfQVeIQ/57kr2Xp3xOxtq0E2qHgsl5uIvKzx1S4+5SYNvwVpFzSW0TXg9F6wMRpvtfef6QKJPNJbuBMQhrH9tmEInW7HKpD3Rj0Rxigb/MP2rkrIGOoUChb+4Ww/8y4SDg55R7B+gxNZICgqx3VRZyGdLyJnw3hYcBt1LucdclfmD59MPcxSl3e2J1/gE53Ba6Hf/C1gjm4OsF+u/CDXok8peRL04r04B1LYEjJ0hCPZfXQtTfQSmcAn7ZSAMoLxUMYkiUp1VJHAIzioWYeqlUZVk5075RzuNeWgE2M+enkV90AwSq3DoVlNq1W9X6Al97yYSY7iTNXMLR/dcI8WFIFu+Q6TeFdL0msd92hUGXhHvhoUmfS1ks03hmo1KFrp9224x2lQQev7tG21dYR8odqpWPX+sjEzcQC/qUuV3SASingwa+nepHZ/fP2zK68u54fE3mBeUVvWVMl+U&X-Amz-Signature=5725e03f0d1aaa81d0f851134ea67ca665bc9e0da705fac1cd01b30e88cf1fac&X-Amz-SignedHeaders=host
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602555141744979" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 220 chrome.exe 220 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 220 chrome.exe 220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe Token: SeShutdownPrivilege 220 chrome.exe Token: SeCreatePagefilePrivilege 220 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe 220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 220 wrote to memory of 116 220 chrome.exe 82 PID 220 wrote to memory of 116 220 chrome.exe 82 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 4444 220 chrome.exe 83 PID 220 wrote to memory of 112 220 chrome.exe 84 PID 220 wrote to memory of 112 220 chrome.exe 84 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85 PID 220 wrote to memory of 1192 220 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://snprod-aps1.s3.ap-south-1.amazonaws.com/ap-south-1/cs1262612/1715756599376/15052024_env-fail.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA4U6DPBCPBOYQHOWG/20240515/ap-south-1/s3/aws4_request&X-Amz-Date=20240515T110117Z&X-Amz-Expires=900&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEDsaCXVzLWVhc3QtMiJHMEUCIQCozl+OV84akcBvgUI/CVderXCNrxjdh5t0hl4rM+higQIgfXzrvOD3U0Ishjc+dtOF3sUMDngBHDax/ScFvYcxy78qzQQIpP//////////ARACGgw4Njk2MDM5MzY0MTQiDELfKL8wobVsgfWhESqhBGmPj1OBNk04oWmSNm1lxOtCieimakGvHF9aBA17R2LaUDGVMmMsrumfptK8GrIwqugIA0EJ8Kb2eBWDKoXLvpPVOdVHn6neOe6WUWTDFrO4mUHrRV3zfETaEcIaCof8fz/RPWtBMenl9iS+qQPh628j3j1qREpgjwRrnjSq5+lB3Wgcc/JId++pwRks48oCVyc01son35b/zBMuwqDEg0vp4oG9eoB0o9x5S6rvS0yizUaKNXh2tQeHm7/4HR7i9zkM1EzRG56eKAojJsKBQYunn8C/SKiJMhMRyEAqREcZtJYvydLywtLQVe9P8MQ3bDqnYmBsWRx4s3PBnMaXLFHuqFAal12PD0R59LX/hoBKbTMmLP1bekvZImSjVEw1UzzL0SKeHtHmcGb+xt0eUiNwcKpEKrDGdqNBd9ph9vXeg1Zvc8Vz6ILi2VjN9XWB2y8uuJWrLM3g36k8GqmmAA4TB5pwNmf20HkHrXRvlJGawUFxCtDvg5Dox0Lp21EtePG8OwCwVWfE80+pS+Bvv31Ncqu1b54qdfH/h+VP1epOYzcXUvD7/UcWK4Pi/2MJjHk6NalAuzBAhsb+keJNUNFxqvVhG1t3WAqugGpcJRYe6oskfQVeIQ/57kr2Xp3xOxtq0E2qHgsl5uIvKzx1S4+5SYNvwVpFzSW0TXg9F6wMRpvtfef6QKJPNJbuBMQhrH9tmEInW7HKpD3Rj0Rxigb/MP2rkrIGOoUChb+4Ww/8y4SDg55R7B+gxNZICgqx3VRZyGdLyJnw3hYcBt1LucdclfmD59MPcxSl3e2J1/gE53Ba6Hf/C1gjm4OsF+u/CDXok8peRL04r04B1LYEjJ0hCPZfXQtTfQSmcAn7ZSAMoLxUMYkiUp1VJHAIzioWYeqlUZVk5075RzuNeWgE2M+enkV90AwSq3DoVlNq1W9X6Al97yYSY7iTNXMLR/dcI8WFIFu+Q6TeFdL0msd92hUGXhHvhoUmfS1ks03hmo1KFrp9224x2lQQev7tG21dYR8odqpWPX+sjEzcQC/qUuV3SASingwa+nepHZ/fP2zK68u54fE3mBeUVvWVMl+U&X-Amz-Signature=5725e03f0d1aaa81d0f851134ea67ca665bc9e0da705fac1cd01b30e88cf1fac&X-Amz-SignedHeaders=host1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94dab58,0x7ffae94dab68,0x7ffae94dab782⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:22⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:82⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:82⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:12⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:12⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:82⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1896,i,11164342757537482997,1178712418980481730,131072 /prefetch:82⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD513c27f8d8fd8a48373a40b078ea84dd5
SHA1492d04c4f707aadc89a2535b00e339de9814e647
SHA2567d3e22025b97f83d9d0a08d5f7727c32318f3cc2810e9f839a7b04dc5a7b3b63
SHA512b4b8e855125d66401534190676b894cf46cb81f20f270dcd9c0738cea111728a7d7e73e31eb0d31973daf6d02575979323f28b12b19a915162bb118d127ac0df
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD55c01a2fa7ceee64cf212d7d251df225b
SHA188c9e8e8346ef2b59dc2359212ca68601f3aa107
SHA256218ef6177ffcdae03af157efcedcc28e73e0ff61e7825ac27c39f0d7f4bda065
SHA51269d57deacf6e9a88a1b0af2904cdd8edfaff797ca36e9a051f0f042d4cc6e8b58e2338d4409f12e299aba5a8af054bac1292ab58cb51297b661d83fda532e4b8