Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 09:55
Static task
static1
General
-
Target
2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe
-
Size
4.0MB
-
MD5
924a00239595486554b80666c0e790d9
-
SHA1
0791c6819eb006412b15b5d588f18d68d03ef0c4
-
SHA256
cd500643aa5be66fcc290c4ed013305ca74673b6ec941924154c4e495dafbfd1
-
SHA512
7e7ca65fd87440defaf46757383d09a8ebf0effbbd0beb358067bacbe5b7e543bba4c8aea4c3043e1e2159ce2f725d4869735a2a3433213dc72a5577db2e6cac
-
SSDEEP
49152:+ndPjazwYcCOlBWD9rqGpi0iIGTHI6DOnIIeNxu6xl1aZt6m5xbzDI6bpsRJrAGG:E2D8MiFIIm3Gob5Ng
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609317597598792" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2220 chrome.exe 2220 chrome.exe 4964 chrome.exe 4964 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2220 chrome.exe 2220 chrome.exe 2220 chrome.exe 2220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe Token: SeShutdownPrivilege 2220 chrome.exe Token: SeCreatePagefilePrivilege 2220 chrome.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
chrome.exepid process 2220 chrome.exe 2220 chrome.exe 2220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exechrome.exedescription pid process target process PID 1972 wrote to memory of 4616 1972 2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe 2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe PID 1972 wrote to memory of 4616 1972 2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe 2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe PID 1972 wrote to memory of 2220 1972 2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe chrome.exe PID 1972 wrote to memory of 2220 1972 2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe chrome.exe PID 2220 wrote to memory of 3352 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3352 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3296 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3092 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3092 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe PID 2220 wrote to memory of 3044 2220 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_924a00239595486554b80666c0e790d9_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=124.0.6367.210 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff626d296b8,0x7ff626d296c4,0x7ff626d296d02⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae9d69758,0x7ffae9d69768,0x7ffae9d697783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4788 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5040 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5196 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff752657688,0x7ff752657698,0x7ff7526576a84⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff752657688,0x7ff752657698,0x7ff7526576a85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5296 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5676 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5756 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5216 --field-trial-handle=1896,i,10601516029483207742,7284917395019509951,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\1767af7a-5b07-43f6-8a22-4ede60dab2ed.tmpFilesize
488B
MD56d971ce11af4a6a93a4311841da1a178
SHA1cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD585cfc13b6779a099d53221876df3b9e0
SHA108becf601c986c2e9f979f9143bbbcb7b48540ed
SHA256bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3
SHA512b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.jsonFilesize
851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.jsonFilesize
854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.icoFilesize
193KB
MD5ef36a84ad2bc23f79d171c604b56de29
SHA138d6569cd30d096140e752db5d98d53cf304a8fc
SHA256e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD518230c65db4b70c4053d3a4a283495e3
SHA105cee1764509ca4b02eed645809ba20994080373
SHA2564b4ed33b43f063bcfb0aed9d38cbd3086a4742539ed725c7ef1568aae87e8f70
SHA512697a136c0e5f897cd69f2c1652d5452d026f6e8099fb60f2a8a2b79a7f10c64d6ceacc69d5e2fdaa70229a16690a35f5420818522f4979e3c48d44063482cbb9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
367B
MD535482bda62277974315fc35001994bce
SHA17b6d521d9c1e92929c398d24fa08ffed84787d0d
SHA256c22354a989973528c15e0a630094092d764adfdf7bdcb900bb3b725caf2240a9
SHA51222958483a507a9742a00b60f95f63ff2e502bff332667ae291bb8eae278cb74ded850d1e35c996fd833b592649b98e97ad553ac224888ca3a583e04c601255a3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD501a6ea3e7978464930a7b623e8af71e6
SHA1d32e7caba474c7939d909644f83c260161ae09d3
SHA256f986babf4898e49df40cfad30c603273de973ed44937c390e5e5ffce525ba039
SHA512af62607e884c63865d1a1e60f7263a4b6ae77ca69b23272acfaf0aebb0256f4456b2a7c50d2c55830daa433914791b02e0dba00cb5afe53351f8c727b8874a1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD59374e5634d73dcf93a2a76671fc8fc1a
SHA1a01f9b09cab49afff51591b1ba38624622311801
SHA2560cc3c3e586d0189230750acb6df3cf290df01c3a57e75c221d9f21b14e2d4ccb
SHA5122cb1ab543c210f1157d6f894217a481479c7597a8bf7d4b1121b893456b4d9a540fd5c2af5ba337cb61adce4c6f275a9048afebc345b6c5778b57142bafcadb9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5d696630bf2a8e54cdbae39ff661d1e58
SHA1ec442615953d98db5e45a3ae98b10828db64563c
SHA2562b617ce57a2be28f189ac9343401e8861e53abd48c4953fe76c6814a64b53225
SHA512039f780833378d3b2c6d05f97802dfdb9ee3a8bdde804930a272e7ffb3935311066db826736e050b9bfcef5f934cb12d255b9f0385e24bb1dbefe7d4ae9d7bb0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5815ed606ec23b2788d9d8e0ed976e8b6
SHA114feaacec4411f4f2b3aff1a96b2c978afee6f4b
SHA2565dc3ffb49e387601fb504be9a745794d14aae4c926f87443f49fc58a4c3b9f9b
SHA5126d29806dfdb5507a35a89e82d80ed2d2a637b8f0d30c758caf909c81716f83965d756772af13514777d09fd1b0782b9fcd5b6df689002250395c9713bba44817
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe582baf.TMPFilesize
2KB
MD504695aadffdaf28b5be826d27d48721a
SHA1ce79df7c80926a86b0e1a922a05bcab16c7620c4
SHA2560bc76b0a74faa8d4d25cfa28127c42750e86004af7a10d590e07a33a89726b51
SHA512aa3438c4a09ea9c0c52dccb6cba636ac99c11b47a5b78317869823d6c39bfdfa304f40e67867b8ca9c4269efaba12431ae59a1d54c671f38acb9e4fe3d23da54
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
13KB
MD5b7a491af444f7477ab43df4a1c3b0c7e
SHA178a9fd759a52e7cfd6dd73fb2ca135db7e94e2eb
SHA256a55562ffa3b5b29020e0016e14e469b098b70d01c38e05066090c6a0b54679f8
SHA512d0d1661fa7b1905432c477cfa7f001beacc1605929dfe75e5fe9d954aefe6ebc8d55a8ebb89e8fdbac5e1e7f27214dc65f99052979b1c1052d70f94e8cef1496
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
10KB
MD5f8606e27763bf15f1ce0d9957b4a83b8
SHA1ef0cfac483fda3723e802c80621ded667df40d7f
SHA256b578ec8ae8a12a26bc1a097cc92b3e0f3ddb1eef045d10bf830bb24a1e3f0839
SHA512c8e79d703f51d112f2a24ba3b193f6bab313714d045d25f766838db3a09b12d47bc981e5cf3b0a918c925d52b37b8106296c2e5b2c56b306a1fa29fcd5187041
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\chrome_installer.logFilesize
4KB
MD5e2a496117d79cca0cea9dfcaaf8bd4fe
SHA1f4ba6592c15df0110f4cdb457f3e47eefbe54021
SHA2568447dc7ae20d1eb9c85b780a20a16a2b29d7a81b9f075f7c0bf67645bae69538
SHA5129b5e091be959f2dc88f366a50972eac1e1a880f3b9f364b3ce88af3f9e615b17d173bcba0228f89b4347beb67b099fd9b92ab90d6fffb2fe8e003e2196b8c932
-
C:\Users\Admin\AppData\Local\Temp\chrome_installer.logFilesize
6KB
MD59fc41156e7dbd7c67d9964b89cf5c92c
SHA1cf2d0411d36991bc69b9bc354c2e926255be3940
SHA25626d40b83e3d7d02d357f203abc86aff26fd6c5068b28366a7e9a98622f7b7347
SHA512e0e2162fb5751598fbba10f5cc31b2c0c853de2b5e39f84b5d1b30d015da59b79354ba818db49ee6fcec9ae971a8ee0ab5989ed5c1cf0fea42fed16d32ef06fa
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2220_242686587\CRX_INSTALL\_locales\en_CA\messages.jsonFilesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2220_242686587\b81caf38-d44c-44ac-882f-788ff9e9cff7.tmpFilesize
88KB
MD52cc86b681f2cd1d9f095584fd3153a61
SHA12a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA256d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
SHA51214ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
-
C:\Windows\TEMP\Crashpad\settings.datFilesize
40B
MD50e1a0df5323f02fa141b11070035f203
SHA14662c48107aebe02429f78dc0ab4328f88ea9e8f
SHA256169bdddd028372b9c8dc1bbc8bc1a48dce9089467cf7c3b5967ebc20713b1bb7
SHA5125ef418e1f48b459f21f15f8462fceebbe5da2e16ff4cd02a614a6a508c1a9e28527c0d0778840600c85ba60d412de91e754b3aa0173ac4db70460367a2abc6e5
-
\??\pipe\crashpad_2220_QEFYOONBGXRQCIKYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e