hxxps://we[.]tl/t-wJQOPHiDE6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://we.tl/t-wJQOPHiDE6
Sample240528-g4vxeahb6x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613509362090791"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
5560	chrome.exe
5560	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: 33	5460	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5460	AUDIODG.EXE
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4824	1408	chrome.exe	91
PID 1408 wrote to memory of 4824	1408	chrome.exe	91
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 3444	1408	chrome.exe	92
PID 1408 wrote to memory of 2484	1408	chrome.exe	93
PID 1408 wrote to memory of 2484	1408	chrome.exe	93
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94
PID 1408 wrote to memory of 3080	1408	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://we.tl/t-wJQOPHiDE6
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a21cab58,0x7ff9a21cab68,0x7ff9a21cab78
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4220 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4516 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4660 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4816 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4980 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4992 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5128 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5452 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5652 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5748 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5452 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5060 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4676 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6232 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6332 --field-trial-handle=1840,i,9707265651908822114,14574732583664369765,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5560

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:5156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c4 0x3cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 108KB
SHA256 aeb909116881e83f54f709a0cdd20f8e70c9d035b76e1e65ffa6f80d739fc523
MD5 ff5f6eb22cad5bfbac357077bc963f07
SHA1 7926b4fc2d292ec4e007bfbfb08b6a1ca93cbdd3
SHA512 f10efd05b45ef5baca758c2de80c31853b25268264dfddbb0f513d33cb96c91886be7abcf343fbb347318d7df5d437d538821e4bf0ce8d165c9fa7f15840b1a7
SSDEEP 3072:ZjaDqs4ITPXco/Tz/q3IipsK04KHceL+xs7s3R9pI/V:ZjaDqGTPHTzy3IiUdMs29I/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 67KB
SHA256 7b1161fc96a4f09a9517cac2d20797cededcf8bbbc5c0cbf9560566c642903e4
MD5 ed6fecd743989507843ec8f23cc04c5e
SHA1 3201000d45b788b9fc98d295ec33bc6d722e780f
SHA512 d49276af0dcbaf22100700e298988bfd671aa7972eafa745a0cf47b9e8b287779fa95d7efe5857c536d1e279ac71a9589c72b96ba7281cf22db6f37948c12f28
SSDEEP 1536:NjPbVmKA4S3i7fdBpZ2EDhUJBXGWbSbkVvL8qiJ5rf:N/Q3sfdBDPqWvojC
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 435KB
SHA256 9e278fa119494e4ec2c0316781ad1bbdc0d9a052c3fb9ae2b05c6455d0220fcb
MD5 230366fa3a27e30ef1ce4e5f91f7bf97
SHA1 1b3a4991de2a3b87a3fffe2f2b18abc68e48e9e4
SHA512 8a640a5ba877b5d29d2daa3bda9ed5ca44b0d8c6606bf7f95e6312c790d2bc70ca315b45f103632944d135fecf61624f47cfcb30254179594eb08d93a1c109f5
SSDEEP 12288:MgROQvvymj9NrGgNuLNB7xNfFGieDUDbjmV0oP:Lk4jTvNwXx5K2poP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 525KB
SHA256 11f4b866e94ef4cad69ae58560af9a33d2b0f841abf1b92b5c691f3dac7027d1
MD5 8a70b0cad18a7aba9967fa18d3152778
SHA1 8c6cf307a5b04d19e66998df320a7ec4f0309271
SHA512 25e0bf2424846dacb0ddd32554851aab17422889c84f34161f150f109c6368e833abec182bd60e80e4cf60e16b201d331d12838486180b95b9f687d3254c41ff
SSDEEP 12288:rlbV+ezYCgYypIy24SQzFvCSSVQIptTMT2qHnad:RbVtypI54dUVQU4T2qHad
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048
Size 1024KB
SHA256 9ca3ecad83e2db5f9ecf77a307b88e8ed822722a48a414fa8ebe9ba9cb2168d6
MD5 7ec2410a5566f9ef99b8371f55119c3e
SHA1 e33af80871db901edd38eb5378653024fbfa699a
SHA512 80ec4ba4c0fd114fb09c427a12d30c1f870bfd5ee8c4783111880b1339efb693353a9be478a49713f58a3292e53f5b5faecc962c1c4440fff32668c3e149956a
SSDEEP 24576:eWR14d5hRcQiLvI3T33VLTrGqBAxvCvLS0XyDi7wz8P2qWq:DY5hRcQmvI3JLTrGqBAx8eDawzGN
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 03b9b2791bd3c619970c09491b7e0c9ccbe6f8e101bd071b3b624c6015a7bcf2
MD5 b243aac1a1b6ac53d532f010151e21ca
SHA1 623e3afcb9f8ea99daab0086fb24ed971956a581
SHA512 0413d141db4bd91a50e630658297ba61eb976cf978c2003216408b9e7f870cc5cc21b3cba9b01e678b6ceedfcc607d8bc12448d1648044ceaeb3df702392f28e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8c1e9b842481469a129ef62087074c0fc9f8ea6916348e554b3b862d71971e85
MD5 f2b78d57f6a316a380dea71bc3df9c66
SHA1 5faf2acacd21d974cef5f41da953656fba94af51
SHA512 8ad49cc5ff9162c37105c48a948d2762d8d1b65f52980939c99bef838b0aaae982ec16c8731f06138284fec25f882d76e6befc50467923d48b611b879b2dfcab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f8558c2fda07b80f3705d45706cac41783a6f2b417dc613253a71198d2bbacbc
MD5 8c1ceeef3eb3062f641a36144788e620
SHA1 307c78a946496a9f6808e40b7922809519af905f
SHA512 cde5744cbaefd3f0c645ad481ee0ec1dc1619666e61e45bbb2e89679bfa4c573a631d27639aa2c297a2d79b6c68a5cd453399e78dfe4904db92af7f89b1fd4f1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9dacd6418f1e480e7627c8162d7389733b96755890ad5e7ec18531cac66a3273
MD5 17cb4aa90cd5212b0de42c297b33f7a3
SHA1 edc0271f3d5b1d6f17974d39077d86263a3b756a
SHA512 1ee3258113cb03c2f8524f2cade3b08e28edc245c94c2be531280e6c2ccbb88d684d19d4395fe1d0a8e4c2f19d0875d737c93e34c4a6d74a611e6ccf5403a3d5
SSDEEP 192:LHfHNHHHTHpHsyHuH6IHMHYHNKSHkHVHYHzH6HgHgH4H6ZHOHDHwHoHMHpHWHmHG:LHfHNHHHTHpHsyHuH6IHMHYHHHkHVHYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 234f06ec61e3489b058de3e3a6181f4d2bfdb006ca59f4647e555ccc8252cbcd
MD5 5341e66b3b7a9ab292083ec704a751a6
SHA1 874f0fa873c214db2eb6054acf8ce569def4e429
SHA512 5f17255a12a3a70084a38779011ed314856f09106a87d2b8d5534d1126a7794303cd6e962db1396046ffb2043203044b5894f5266d21e10a1f6f5622c6aea853
SSDEEP 96:FaeUJdUryUgUaZUq2qUU5xUqR3UaUnUAUYUZUhIUnUiUMqUmUZUPlU4U7EUaU0UI:FhUJdUryUgUEUvqUQxUqR3UaUnUAUYU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 68967f539860b909a2968f664a69ebb33bf0ffb53fac835fbc57d07d0ea62fae
MD5 db252a8c4be23234d98fae57a19aa67f
SHA1 c137fa1322b547ef9ca042fee45f1e8415280df9
SHA512 056ba5cde74fcabc87b8c69a784074c105aeec41a028baca6fbce745ebd736cc1520ca03c85c6532376c097aa4136b034a8284a1d4862782bf4c218f90c1934f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 37facc4a6adde93057212e9404ef262c00277edb7504728f22a995c34ce6075f
MD5 39b816fda5e5ebe901ea30b42b7eef7e
SHA1 a03943956d9eeaf81ee51994a9688787842f9d4e
SHA512 5af726b2bf75d69c325e66f3d1b79f2e296bad5cbc71aa8cd5ae701279ae25e12c2dfc8dc0173f26eccc5040ed0ed4b0019d6e48c79a3d7f1259a7e2f207b307
SSDEEP 96:jaeULdUryUgUaZUs2qUmxUsR3UkUnUxUvUZUhIUnUiUMqUmUZUPlU4U7EUaU0Uej:jhULdUryUgUEUxqUmxUsR3UkUnUxUvU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 b86dd5c6b82720d9370d7fea1ee39d61fc6b36fee9a9afa47b8896ed4ffedfdb
MD5 344ed08afca548ed0db71a1c2fdc7a91
SHA1 f475a28fffb0fd52037cd0a6d271c5d316179ebe
SHA512 384014bd777fb2828e8d0d8a61c04119924e28d17ac06b81e349d94b5aa52a9bfe8834f3f81b31228c9a493e366a995c8f707799c31e574ef8dd4c103de8359b
SSDEEP 96:JaeUpdU6yUTUaZU62qU4xUqR3UaUnUAUYUZUhIUOUlUMqUmUZUPlU4U7EUaU0Uej:JhUpdU6yUTUEUfqU4xUqR3UaUnUAUYU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 dcc275fab678ef38f4560c1e0fd3a790eba1c9ff08906e835c936165f4228327
MD5 ce98db70579fe6f65cdc4fc9af94f43a
SHA1 aecad04bec79543d82836950c3613e46928321e8
SHA512 4baa78f024a7b119cbbbddd21f02d463fa9ce6aa8aca61165bb2c3bfc04fb2657084ad3dedae1c7855be3220dc6a703ce5c786a6ba1b147f6a122bede163dffa
SSDEEP 96:naeUzdUGyUvUaZUq2qUU5xUqR3UaUnUAUYUZUhIULUiUMqUmUZUPlU4U7EUaU0UI:nhUzdUGyUvUEUvqUQxUqR3UaUnUAUYUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 a8b10f0f110c04fc759eccf486e82c351e449b92e14b2b5c7506a26e24721255
MD5 08eabf594977864d48155ccdd0c058ba
SHA1 6c453f1d4e00f692767d456669333f52c9688664
SHA512 e5dbafde1fe97721276056e00380475f3e1326bcb7cb733d7be77ee45576bdc403d0ea01c4bfcf430157a31306732579dfc0b6fc7bdad49d2cda4197fe7df73c
SSDEEP 96:FaeUJdUryUgUaZUf2qU9xUqR3UaUnUAUYUZUhIUnUiUMqUmUZUPlU4U7EUaU0Uej:FhUJdUryUgUEU+qU9xUqR3UaUnUAUYU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 4f0fdcdcd59b2f631882f8a5cb45844f52ebda25ba6ad8cd14055c682cf47087
MD5 ee52a633860c034c9f4a0c1936ed1554
SHA1 054f1870c2284be5fd57db5e3c3ee681e93f9c59
SHA512 f2d11e1b3a09eb1c8a294548ec6c5aa41026589113e3dc83d1be43a797e7f2699cf9e4ff80ce4842833c539b40e2d9caacbbe09fb7644a0d00f08fc6a586336a
SSDEEP 96:OaeUqdUayUJZUaZUA2qUaxUqR3UaUnUAUYUZUhIUUhUZUMqUmUZUPlU4U7EUaU0n:OhUqdUayUPUEU1qUaxUqR3UaUnUAUYU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 8ad11852b551b0a980c2ae87ad007a0bcab9ed68c26779f3bff98f75a6500b90
MD5 9469b17e5eed939b0d3a409b68b52246
SHA1 2c143be4f12ef96d17875d77d318f069922e982f
SHA512 1852f43026fc46757944329e06dfea3c87ecdab52bf4539e724d71b60c175256cb9dc909c03e0b1a1a8cfaa80b87cb9c421d4afb332215ed93bc723fbac8170d
SSDEEP 96:A1aeUodU6yUTUaZUj2qUpxUqR3UaUnUAUYUZUhIUOUlUMqUmUZUPlU4U7EUaU0UI:EhUodU6yUTUEUiqUpxUqR3UaUnUAUYU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 497ceae95290b84a3bc4fdbab36cd7746dbd07a441c561b654aa47e16cab43de
MD5 e94a44f9aa4c4efc0fdeb151c5706f64
SHA1 6460ee9e9fb364fbe28785b36e2345684ab539f4
SHA512 b82e3a807e86401bf8d50f83acf185f7e09c02b37fa5930a6d63341cbc8fc915e3eb5703ccee1af493a03df7e7a78cac67ab2b76a992ffa6b49bc980688a0dfa
SSDEEP 192:5Lzocbd9aJOf8syh+F+UU+vP5tjEsXtScR:5PoBSyqS+5tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 2d90b69ac07f1bbaecdba2bcae63c40eb98f1d23f30807d670f91fcab73416b6
MD5 29641fc61ead2ca7067a8fe4bfbe3c93
SHA1 72f2c400ff659dbca6bfdda84f9e93f99e6e6214
SHA512 90d339970a2ce0444710f73efb1fafcfe3b0cebbd5f194538bd642bd30f2abf15d4facb892df7b61b87e19f0eee58b636669dedab44ac28e611d84bef20f8e70
SSDEEP 192:5Lzscbd9aJOf8syh+F+2q5vP5tjEsXtScR:5PsBSyqa55tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 213ce1b8a20e51443f9d36f7fe4984d2c787839991cfdddbcb1777a37c131a91
MD5 d493a41fd8be233f23d8459953e53449
SHA1 76635a3575aa8ecc78ef1ade10d5dfec2d78b373
SHA512 03f16c3ef9f489ada45b160be9973fc8218f82d69cbebc0f6ab980a6fb2042273b369d39f6820a40f5c52cffba08da3fba162e0d1b3a004da3fb2aa0b8b03502
SSDEEP 6144:1rI1Qo5yzkpeXjnJFzXsW/QYRPILxZnhLMJjX0EeGzY2rLWL:1EjCkpeXtFbbQ5fnReEFsLLc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 aeb93d985597f0b8dc893bde0c5a6b9b13d7b8674d17cd22fd7286ba189e6040
MD5 7c1700683c9d183fef1bb959125e71d9
SHA1 00677eb261839de5a44c06c1c9544cdf56e898f7
SHA512 7bd24e98e7db5a9545b0ccece56f7cde641df738f8faa1447a2dd6159f4b1c778143ebbeb7769bcf78f0112c66a65a3506c7865c50d471c7ec87f9d4b93e1d6a
SSDEEP 6144:MrI1Qo5yzkpeXjnJFzXsW/QYRPILxZnhLMJjX0EeGzY2rLWL:MEjCkpeXtFbbQ5fnReEFsLLc
MD5 SHA1 SHA512 SSDEEP

Submit Download