Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system - submitted
03/06/2024, 15:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe
Resource
win11-20240426-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe
- Size 1.1MB
- Sample240603-stsvvaag4t
- SHA256 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da
- MD5 0fc103dd825512a9a4ea9ded6ce550e9
- SHA1 bf488755730be5f03732f5c38c97664e9e2fcc0c
- SHA512 a6d0aed9e55246c5f56354808d9a4dc068497a8978c227c06d5d377ceabe68b1cc50484cf1f25a94701280c6c709db37173fe5eb5e13fc11fc751f1d7facfdcf
- SSDEEP 24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8auG2+b+HdiJUu:CTvC/MTQYxsWR7auG2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619019326076350" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3938118698-2964058152-2337880935-1000\{08932F15-3FFE-451E-83BB-94473F383434} chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3660 chrome.exe 3660 chrome.exe 2676 chrome.exe 2676 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe Token: SeShutdownPrivilege 3660 chrome.exe Token: SeCreatePagefilePrivilege 3660 chrome.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 3660 chrome.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 3660 chrome.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 3660 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 77 PID 4952 wrote to memory of 3660 4952 65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe 77 PID 3660 wrote to memory of 4864 3660 chrome.exe 80 PID 3660 wrote to memory of 4864 3660 chrome.exe 80 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 4796 3660 chrome.exe 81 PID 3660 wrote to memory of 1292 3660 chrome.exe 82 PID 3660 wrote to memory of 1292 3660 chrome.exe 82 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83 PID 3660 wrote to memory of 3768 3660 chrome.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe"C:\Users\Admin\AppData\Local\Temp\65fd3bb3f97bcc6126317bb13eb62a2b0c10863761753249857a321692ad53da.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe2fe3ab58,0x7ffe2fe3ab68,0x7ffe2fe3ab783⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:23⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:13⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:13⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4216 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:13⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3292 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:13⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4432 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵
- Modifies registry class
PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:83⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1852,i,14964177001075814738,5144192856346094795,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 6af4e16b45b0bec16877c4a23c76eae36cee47876ce4043c64b6699999d8514b
- MD5 fa668bf8edf6ba0cf22aa823c413fbd1
- SHA1 ecb03cf9c28a1154892fbaafb99212db02467d69
- SHA512 ffd8896dac47f0d29ab8c3c59a79d8aa2b66549d67f086dbedbc16ebdbed074407911872572565f4fd9830a8b7b1933e56eb83b5da37c2b96ed043562d39dc15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c037cc3e5a40517e93a6e5f8d9e5f9e6c937a0b9f112301df49135081e9266ae
- MD5 d8e43a513d3cdd3edb11379e790a76ce
- SHA1 649d41f31ef4aa411bc91153886c40ad1fb6b62f
- SHA512 47210ed6d4fda9655d95264dfa954250707f6f433f324e7aec12730f30a51cabc358870354a84e648ff9e41dc7228295b896d3d131b6100f14fb594955c70974
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b42d6e0b1df1ef69b5c2025072a189a35b6738c8008b1b39fe157cfaeabb94ce
- MD5 d7c1b95880b71f036a48eef8b6579ed9
- SHA1 faac5eae4ed549d90ec04a7e3f333385df22473d
- SHA512 660dc41bb859854ba2c8ab797303a94638429107d30543024efdd1f3591cc4c242c58e88ca19439767c8bbc695d224374717a2dbead7f377b9a162ca9293c272
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 522B
- SHA256 951a68b59e5eaa8a34daeb2e5aafd7f94bffed5416a22da7a57da137b989490e
- MD5 7d2c32362e48b5ea18c13019e00d12b6
- SHA1 9297a899b90231702581f6bd7999376e47228013
- SHA512 94624a6a98898f606f87e689732d36b1fa8f7d1ff0e220a63071e5453465583f44f6f4df312328578d5fc60e8dfb4a9266c4144805254d2afe1e03a4369ee203
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 524B
- SHA256 d86dac9d65410f82461882fe6e9c487b685c1a388325b739fd7d72b885eef32e
- MD5 f3ed8be758ce91a7f7347b4f00ff3e01
- SHA1 6f80ebe70a1208c01898131544dc13b416dabd45
- SHA512 a6cdff2963470702284532b9856358ddc11b82f0f68bc25ce2aff32f48cf7927dc1f050535d4249fd1e831a52c61f8ec8518d054a235de9efa5ec960d80ae4b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 285b250aa20ab5a4c2c8e05a5e7e3f7b665ec1b776e31d0577ee24ddba90f53c
- MD5 0e1ac715000a22d9e365d639eec06341
- SHA1 851ec6300a2f2e0575dfd6d8627080bcab206e08
- SHA512 ceaeb07b8a0b573cfe232c3ad382264463e44f18fe2fe335b929ee507f15cbe4e738da31315fbb7acf7d90513b71823a0bc7aaa66856a97061a394e83703505a
- SSDEEP 192:IPXzxsrTS8aJOb8CQayh+FzIqZvP5tjEsXtScR:IPXzxYWOhQayqzlZ5tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 6e8e9c39c985e4a86ca510c0f47282e6990deaba3e00dbb7f8a67c56eac60d0f
- MD5 27a66954d2bfc0ad653eb8e390d1cc7c
- SHA1 8f3a080e39e0da1343d2bb33fab5a0452056c2f2
- SHA512 44ea5132b53f1620df7012d5ce933dfd20fe31a9a634aa1b47d46d4466b3c7ab12cdd101ac892f35ed59516cd03ab939ef67fb697d2a27fce4ed11d613ed02e1
- SSDEEP 384:nTkW7pLhLcEv1XXzR1kXqKf/pUZNCgVLH2Hf9+frU7zHGSN9wipN:nwW7pLhLZ9nzR1kXqKf/pUZNCgVLH2Hz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 260KB
- SHA256 f5119308f8d81c51e5cd0e0066ff0fc86dea168ddafc612666deac731aadaf30
- MD5 d0815dc797149dc54cdff51b9a6dd972
- SHA1 03465b7461c9959fb557e7ec0067048f467107ef
- SHA512 fc4794c11def8231ec68f041abea3572269dd97da65c9bf845a704d4e396cce4b77dbcb2b84705fe897eefd1c46d002c337954ee907be3c170329fadc6603a73
- SSDEEP 6144:OIjtCi9zPraf3+mD0/U/RVVIFe9T1ckSJz:OIBJ9CfOmQyRVVr7SJz
- MD5 SHA1 SHA512 SSDEEP