Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
10/06/2024, 03:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe
- Size 1.1MB
- Sample240610-eee4jscd24
- SHA256 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde
- MD5 4a741a0918cb8d8160a316731687cd79
- SHA1 721013190ca23e340efca86be12ea1014d020200
- SHA512 e24d5899a27a7ae5e0fbe1ed62a55f32f4ad186f3de692495d19b43ad369ea8e0c798b2b3c82b72431b5e8fa0b3e866892fa6e96f0f7cba2bac3e5b3e38adf0a
- SSDEEP 24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8auw2+b+HdiJUX:vTvC/MTQYxsWR7auw2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624650645315882" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1672260578-815027929-964132517-1000\{E590D35C-0028-44D3-BC1A-74A79AB469C0} chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 4040 chrome.exe 4040 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe Token: SeShutdownPrivilege 1836 chrome.exe Token: SeCreatePagefilePrivilege 1836 chrome.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 1836 chrome.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 1836 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 78 PID 4420 wrote to memory of 1836 4420 ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe 78 PID 1836 wrote to memory of 4448 1836 chrome.exe 81 PID 1836 wrote to memory of 4448 1836 chrome.exe 81 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 4664 1836 chrome.exe 82 PID 1836 wrote to memory of 664 1836 chrome.exe 83 PID 1836 wrote to memory of 664 1836 chrome.exe 83 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84 PID 1836 wrote to memory of 3760 1836 chrome.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe"C:\Users\Admin\AppData\Local\Temp\ed5ce8d711cb9df0fc928d0a706fbe892d86d54e7b2a5d6ff4f7b4c268adabde.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e657ab58,0x7ff8e657ab68,0x7ff8e657ab783⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:23⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1636 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:13⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:13⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3792 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:13⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3340 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:13⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4456 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵
- Modifies registry class
PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:3624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:83⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1848,i,422331870270648030,1172597941368080878,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 c4b9171893b3bd26db4a8bcdd1c76b3465a7c39eea247d66ed1636a28832bdc2
- MD5 2f99a5150c587464a48d6d436a52185b
- SHA1 284f443d22f41dba3fb759bd2305b59391c99ce8
- SHA512 8886d91a6275f4289f319f90324fd6f41ea28e3c8624c23b197e8e39f6864fd0cd486143a185191a7691f0208d2c23c72ae93cb49e1f50ba79fab86513a9d5db
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 fcaaa54214e8a7ed1e82660735a538eb42b8a519e2b08b1c13759b4951e26dec
- MD5 6f7f2ffd0a09b5965cf65c22cdd05374
- SHA1 59d0eea3f3ac88a8645b111b5365f660d37e4915
- SHA512 7ec66d74a7e449adf32dd30b74e7afd2d7032165ea22cd75f3fe7c889d1fddc8a55afd6993371bb48d48b86ddfda9d1aeb30490a380fed43bdfbeb9e5d6f27e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3a973a69559579351166f2d82c33df6cd337746da457a5cf56e9a6bcbb0165c1
- MD5 2efb363f4b810ccbdeb6680600355112
- SHA1 9d2e07b552351611ffd10a774877aa536280117e
- SHA512 fd8e261b44b9efd0eb123061398a6aab725ccc5a27150884f49d9fd72dd0ff82f6a2788b9c893d10bd2faf8464d72c85249c67d09c2dfb61045a819a8760d216
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 522B
- SHA256 dcd7372893cbebf7eef8f510129c5b9da2e1e299a5459859dd8f1bd09da24232
- MD5 dec318387b3f029baf350cb3f0ee7002
- SHA1 1a8f7e2c77da3ef0304f8451cda419c2cfbb8361
- SHA512 0b9ffe4ae905193374d18eaf461721134ea74a0d640a23836f7a08367d4e559d6630d16bf5c9d92869c78acd15fdf32aa4b6d5f13f28ec4a549d3775a4d8f057
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 522B
- SHA256 870ff273fd2d187bf5e0787ef473e7188fc7dddc963c0180fed9610bda6fd9bf
- MD5 adfa4b1e76554ac82ae97b0493c85d4c
- SHA1 bd617ecc9972f3b2bb1e2644188e0c43bab36b7e
- SHA512 de4f1d4e39cafb85c6aaaf3d117c07ed17bbebd5606d6e85ea89ac3b86f91ea796dc008f1ddeb9b149d92d16201d1b2e843716ccf38b49f775d369d2e42486ac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 522B
- SHA256 e05686499b9bcb674c68649595263b800ee6e79b9f807a510d966d6948ebdf05
- MD5 3fe189506f280876ebf596095b854604
- SHA1 42fae639b82e2de352524369f4ad2f186e449fc3
- SHA512 fed347005cf73036983b19ce18a05e11ede3e1189c36d5305985e25e94229fec4fbaa87053888f0bd8d74d725daca3dd6e0044b37cc84ec99807840ffcb8fd71
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 4a16e0bdcd20372a79f00fc30024a5eb5e3ce4b5453eccf97b0bbe7510f6fa00
- MD5 568c5f153b9ee888db2db2d9c881d9f5
- SHA1 11eca8cf1d8bed9537a2724a6e8d564043fe1c11
- SHA512 47c0421a6ac861813660a00610552b40831e04f936a5d52fa4020165a4ad43f72abf2fda9e76a883b6e15fd314ab97a206097d998bb24d0c9c5159ed98c14822
- SSDEEP 192:KUHXtyQ2OaJp8qyh+FPt7fP5tjEsXtScR:lHX893Xyq17JtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 834d6e8980516c49d6cbf8f4303c93a2755d5d42a0e177e0170e14ac205e65f0
- MD5 f304c57ebed06ed271e05a35ff03d887
- SHA1 c5e7d7f5d2cc9a6da0b2f22d377d5a37385a54b8
- SHA512 0ec37c62e16f5e4d9508bd25921331436d0a4ce6ef2adbffc587c43a2861817aef1e16580dca41f665ff7081a1c4d901fec22078bf4fdba1d00b7a27fae968fb
- SSDEEP 384:uWumLPLexfXHZ1kXqKf/pUZNCgVLH2Hf9mXrU82HGU1xfGm:uVmLPLcPHZ1kXqKf/pUZNCgVLH2HfAXw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 265KB
- SHA256 89f2b7627d9ff98927d55953f334b0634fead70f93bf9d5e73d30df1283046e9
- MD5 e2315ad1d33d48655120c86ea15a091c
- SHA1 a85aef4314f65377be0fca34779e87111cf23b91
- SHA512 17ec888cdaad76749adfc8a9fbcdc3dccac635f0ef663780d59e8e4e71aa100d367bca4463c8abb919fb1ce998a60b945631a648880c8174a88a9ad6c83dfa1a
- SSDEEP 6144:R9XA0K/6jnpr92guD/wrI1Qo5yzkpeXjnJFzXsWn:nHjnn2guD/wEjCkpeXtFbL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 302KB
- SHA256 e469f3c4dd0509256cf26b25e8cc6af666bdee69358aaffd5edde8d18679c5a6
- MD5 f1c56ccdda6816c2ca8ad5091dac384e
- SHA1 fb0bfba10122d36f80bf2a5bdd3e787034d2c06c
- SHA512 41608ae7c1367c8e7697bda8925def98f661d2a3854a9e99c0b2243dd555a41bffc9eaddcc6cec16e1cbda60dbb8b6f08117dae91ff5d309dc31768a722d16b6
- SSDEEP 6144:k06gMy/9XA0K/6jnpr92guD/wrI1Qo5yzkpeXjnJFzXsWn:GgMSHjnn2guD/wEjCkpeXtFbL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 8184e96a98f4e0e405d1741b7f694f53db76b04172944735a44b65fcc3ae74aa
- MD5 9d96ea4e1aec8685f6b9a1d713951e67
- SHA1 2e0a99daba782078a2c24c10f84d7b80a38246a7
- SHA512 26760dae3168ad169ea121e93f3148c35f8a3e9dd9a9e24767426268dd480893b0433aa55c2aacda26554cc276a82cce7529af3958a8466196ff79ad78a8963c
- SSDEEP 3072:t+4Jtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTys2:5rI1Qo5yzkpeXjnJFzXsWv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 265KB
- SHA256 26b1efd4e7cbee6494932ea0b321ba8d1fa59085641332805b8cee164d762ba3
- MD5 55519dea1ee21a497b4ec63bef424ba5
- SHA1 a18e6c076479c38f6fab8285f8c62e52a9a3df44
- SHA512 52efb9752b5a5fd69aa8a8091f03d689b1844b4df45230c5c5be421c79568e4033fbc81c1d2a0d50310af93cfd657e3a8bf8ee2de51462b66e37702faeea7e3e
- SSDEEP 6144:Ht9XA0K/6jnpr92guD/wrI1Qo5yzkpeXjnJFzXsWn:DHjnn2guD/wEjCkpeXtFbL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 89KB
- SHA256 fe37423430ff097cc3524fa13e11afb9c487dcd87bf903e10b658886a2d11f77
- MD5 24b8eb7f93f96489a3f191332f02a74f
- SHA1 599595d56088e7c62ea2fd64544c60db50493f79
- SHA512 ca77ba77f40d3a6bcb223b42683c451a0c3da0b9a748678d41c3a9d378ddc527cfb911523ec0ec7c0a274e8e16a0b2017a0986e6d17231f97082a665092a9769
- SSDEEP 384:vWFSxEQoE4VJ92XrtQK50OU+n80/QoLHrcM4CqM+4LZ9o1LnUHNgH+yFNRhBw/Mu:DiQAwrXIEMu/hOPQK2hZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582d64.TMP
- Size 86KB
- SHA256 c8b07b83f194813452c908a6baec3747fef463fcc2cf4f92cbc1b847be8ad2e5
- MD5 74c3e506d5f4ead0f45d71d80bf61d79
- SHA1 21334a0b53997dc36ab9358484c68dcecddd3750
- SHA512 e87f6ee8be43672ef2d22a6086abd71d5e1c0303d22a40c9cf0c7af9bc25299969e041aaa4a9b70dbc9f6aaf9ee9159dc4cac1969332ce4fd3f9b48cb521d249
- SSDEEP 384:0mWFSxEQoE4VJ92XrtQK50OU+n8QQoLHrcM4CqM+4LZ9XLnUHNgH+yFNRhBw/M1d:0miQAwrXAERu/hOPQK2hM
- MD5 SHA1 SHA512 SSDEEP