Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 18:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target test.exe
- Size 128KB
- Sample240613-xf2ytasbkr
- SHA256 80e9311b685bec877233a39e63761dd7f648c93bcbf9cbf24103c1686d14578d
- MD5 d2828e47b4965a2f4cd5c36f3af0010e
- SHA1 d59b816ceabdd7d9b81c0735144f583e43579e74
- SHA512 5925c1eafb0eaef506ea95d9fcce217bacb458019f5bac79cd7744a7eb86b4e9a54aa3d4b4cb663b738775efb01de9336820389f98d1cc8c6dc1ad5f2f10d90e
- SSDEEP 3072:c28RlusaYC6UfzbspKNMOccF6l3iMAelbWTz6gLYXDMxB:5Rsc6UMyMOUIGbWXS
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627781326583940" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000e245e7cc47bcda019715b9bc4dbcda0100e7f27dc2bdda0114000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3496 chrome.exe 3496 chrome.exe 4016 chrome.exe 4016 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3844 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
pid Process 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4484 test.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe Token: SeCreatePagefilePrivilege 3496 chrome.exe Token: SeShutdownPrivilege 3496 chrome.exe - Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3844 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe 3496 chrome.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3844 chrome.exe 1500 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4708 3496 chrome.exe 96 PID 3496 wrote to memory of 4708 3496 chrome.exe 96 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 1788 3496 chrome.exe 97 PID 3496 wrote to memory of 3468 3496 chrome.exe 98 PID 3496 wrote to memory of 3468 3496 chrome.exe 98 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99 PID 3496 wrote to memory of 4116 3496 chrome.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3984,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:81⤵PID:372
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb91f9ab58,0x7ffb91f9ab68,0x7ffb91f9ab782⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:22⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5112 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4836 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4880 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5168 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5076 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5256 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2444 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4460 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4472 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4424 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4284 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5388 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5420 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5164 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=3340 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1360 --field-trial-handle=1940,i,7560602490066907821,4394769479221144402,131072 /prefetch:82⤵
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1880
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
- Size 24KB
- SHA256 da9a1e371b04099955c3a322baee3aeee1962c8b8dabe559703a7c2699968ef4
- MD5 1fc15b901524b92722f9ff863f892a2b
- SHA1 cfd0a92d2c92614684524739630a35750c0103ec
- SHA512 5cdc691e1be0d28c30819c0245b292d914f0a5beaed3f4fc42ac67ba22834808d66a0bfc663d625274631957c9b7760ada4088309b5941786c794edad1329c75
- SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOD02LhPCrsLblAHQb+WqVPZwpT04q:fWkn0RSdu59s3nOHP7RAHHHZwpT7q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
- Size 203KB
- SHA256 07118bf4bbc3ba87d75cbc11ddf427219a14d518436d7f3886d75301f897edaf
- MD5 99916ce0720ed460e59d3fbd24d55be2
- SHA1 d6bb9106eb65e3b84bfe03d872c931fb27f5a3db
- SHA512 8d3d52e57806d1850b57bffee12c1a8d9e1a1edcf871b2395df5c889991a183a8d652a0636d5452068f5ef78d37e08ce10b2b2f4e05c3e3c0f2f2230310418a8
- SSDEEP 6144:zoGqE/1rvbAPo0pim9XL5mQ65x74c7PhmKZZVTAzIO:EBE/1rjAPo0p39XLUdTPhmCZVGP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 0c1abc6e78b1801b6c2a0071b5e4293d07058a28adb4fb974e3913252cb90530
- MD5 6e2d3ed823762261a9fc1d2de067bb16
- SHA1 fb5325b04fea1974953a77d2ace5a082a81b3da9
- SHA512 d0ec36bd73c412b94494c7f62195104c4bb03255c7bc72a480d1a0784106f839bd488138452d37e8e9b73244934da74e225159041793614dbef2782106bb2718
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 87efd0f3158b16408966de5e0617ce6cc8139bc216ce8be63a29f49ec542401a
- MD5 095910e639a7f6ae5ecd2a147a72a036
- SHA1 406361c509cf222c0375d05ab9c08ec1c644cba9
- SHA512 4638e615800220e8c4a3d89472e1893a58c8606c8e7a4e87090c150cfe9868a89c15378a85b6a93c5ada5b23e070c156b231da06a9ff83965c3a447ecc1c7432
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 08a021d6c903905de4dbed6b604442d3d83883bd00b719b207ca6e77c70e6d69
- MD5 d6cc21ae881bcd792e5e04dbb1b98be3
- SHA1 facb6b233141746db080e0d22173343e3704d020
- SHA512 2fa741eff60c69c5feac3ce338d204fd485b06f99f970bfffc48123d25c8eb10e448432159332bb16f4a8ba7e5188df3b5affe2cab1614232a433adc060eb9ba
- SSDEEP 96:QHYHxHLHGQUHbH+HNyHvHzHfnVHByH9HGH6MMHDHCH6k4HG6HGSHGqcHGRHRHHGt:QHYHxHLHhUHbH+HUHvHzHfVHkH9HGH6e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 90c97a9ec5c85d88567fa4cb0f436a5624804f5464359adb0ae33102ac49af3d
- MD5 9eb4c85cfbdd39a17bfba5bcb0ea677f
- SHA1 c238d3ab4801401c731862c9ac1e8203c3455a20
- SHA512 7fabf4e9b2eefb8ddebc7b2df02647b871f3880c2acfafdbc23826af738fa6caf009f027a23da601a4ab53ac162e9cb9154d823f4a6a3cc286a26b9c5ca0f15c
- SSDEEP 96:QHYHxHLHGQUHbH+HNyHvHDHG1HfnVHB+HUHGHHsHc1H+VHiHKxHhH3HaH8H6QH6X:QHYHxHLHhUHbH+HUHvHDH8HfVHwHUHwz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 690B
- SHA256 0e9758e34596b03719e6dfe707f48a83b61ea1dfab23b2db53fdfe4999eaae4e
- MD5 66422aeba2f556eeea5f7006ec1fe2b5
- SHA1 276ad596fc104992ddbfe9db27043b00afc21126
- SHA512 707fbb0d750b369b02fc59875a362c657f16d86462b781dbd6726fe0a0e311d7ffe47ae3a77557c88e333ab860aaf4685e210e04554843c4fc82d918c46bf660
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 e5322c898b53cc32574aa83fbdc4ab6e4e19d65bb964a841edacb72b42438078
- MD5 0cd2d18d43e6cbfe781c2550d0576088
- SHA1 cca5a46478f6d18ab94da96eec13f620d597086a
- SHA512 73c138a3c1d613dfe494a1b4d0b41aac4edebdd91f44d363fbec49e7fac2c3a7bb237475324e2b02da48629d3d2307010340e827c11d0a662823d3470a928b31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 cb02ef430a5af3359a8e861a5e78f280c73e1f541537786b35f6f55714675d0a
- MD5 d5129d6e61d03b55804b835d808190dc
- SHA1 ddb68cc71c67c56ac89c4f9559a7a94ae6d55c91
- SHA512 cfbd18a3a97cccffd7e3e050a3ba775329ab6a4e23707bddd605f3db260a65f396d66fe9501d360b04b30ee0ba7a14f5e04605df8ca3c57ee1041c15f6f87c50
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 3bed5293d12508d19676781e8d21ed186bbfc70c0a0885d991d15cd2c898169b
- MD5 984b4406ab9abeb27e2a09d213e4eb52
- SHA1 946cbb23c51f3f216dd8545055787b84a04a73fc
- SHA512 d1bf56b9c8773e0a659572c37b6461895f872ad7be1d76873ec37f881f39cd41c644710ed7bf03c06ad9fe7b8297f679325d83463b5b67b67c15c3eab9abf192
- SSDEEP 192:wRx+UWxTaJ+aC8syh+FZQzf75PMFP5tjEsXtScR:wRx+7xO+tyqyzf75PMTtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 7d3795889bba1fef0a02d63b8dda42f3ce305519c4e44f405d161500b3486f47
- MD5 484973160adb9187e08b258b67c91109
- SHA1 9d3cae8d1236cd537135af35674ff29deedeb35a
- SHA512 33e63ae304c3f0ad13cf332d016d9a36d4f0c3584bc839a4db4b9b5c8ec9c110581721de84f89b86d0ef52f832ab03a37c605daa904c4dc16340cca50155009d
- SSDEEP 192:uRxnUWxTaJ+aP8ZUplyh+FZQoAbf75PMFPqtjEsXtScR:uRxn7xO+hUplyqyBbf75PMstIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 69a81efe2596a8bbd2c0b6ca7e4a6a3276510295ebbaab63c5df760bf7bddd19
- MD5 dda424e8a0bee2de7cf86856f0737219
- SHA1 af4f0fbd9e4b304e8272f2d440cd72162ea16569
- SHA512 9404fb7904146195807beee8bc17eedeb7e78be23996217fdad54396bff8a7191354f72f8f377771d61008378fe21a9235122478f4b59fb7eebe47aa671c3db2
- SSDEEP 192:uRxnUWxTaJ+ac8ZUplyh+F0QoAf7f75PMFPqtjEsXtScR:uRxn7xO+sUplyq1Bf7f75PMstIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 80e088a4e2d19e69cb90c92c9b9cf8561099dcffa0cca841aaa123c6f644a3e3
- MD5 46998a3b7a5a77681b3a75735fc58447
- SHA1 1af24be3d727f0950df77ac64f5d9d09d396b5d4
- SHA512 770e4a9b97ea3f0a52c2ae6559a9638a68fb35b8ce2599519c8a9884f052f4edba7edc790e6763d2761fe21d448cbf68fd616e23d4c5d8ba8bb8b81c50e1e648
- SSDEEP 192:wRx+UWxTaJ+aC8syh+FmIf75PMFP5tjEsXtScR:wRx+7xO+tyqrf75PMTtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 e16ed960cdafaef240f806f4d0c902399c2a6ba32d613817312ab07a26845ed2
- MD5 0ff1f702b6b8a84aba68613357314b3d
- SHA1 7fa3ab0c56e4171459f7bd564e320be28f31298d
- SHA512 4a23ce7e1134f8e1c9ed52417ee97d030e0540b889c6afee5ed2a15ae2977e553fc3e55784d16c7611987fbe33eacac00bbd57cb8512f676b19cdf16d02a82f6
- SSDEEP 384:fOf2YJ97pLhLcsBKOf/XwOf51kXqKf/pUZNCgVLH2Hf9HOf3rU9hUHGFG3fBGB9Q:2/P7pLhL9b3/B1kXqKf/pUZNCgVLH2H0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 c78ec01930d676b081ac97434ea29614ab6fb5db49c08b8db710d542cedaae92
- MD5 e365f7a4624dc8b5f30f065bb72f4596
- SHA1 663f8b9463a025dd6379dcc8803d793080f9efcf
- SHA512 60176223cc07d0fc9cc72366095cc6d4be7bfa98d4b685ad315b747f5c6fa4c3cb2eff0408107149dea0f55011b53edfc9464c78198ed4cd14653df8e6289caa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 276KB
- SHA256 174875c983e20cfd1b001a65ea0c893680792bcb525c051204c53766d1c19ed2
- MD5 506c9caf4d559fb50408129922ad5863
- SHA1 a29c83485402b2015d4d16beb7cade5b25fe549e
- SHA512 5a3eb4ced20e245f07938dbf52c9a6f66f3f358830de36fef3a9beac7f066de8799d7057be90ee8be3d6164ade0af13cd3b297c7028e2df9c63c8ead66a1037a
- SSDEEP 6144:cGZiXhtM716cs+zEkJo/ORMw5Qf2RSTIadDpwU5CAa:Qhty+uo/OM2gTIadDha
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 276KB
- SHA256 58585e6f305acfe4778759b5d55f9a8423f344a756c5add39d37e2c185295d86
- MD5 091c312ed692fe0ed34f1471726a9a6d
- SHA1 8db4be565a7d1c50bfcb17245ec07fd560bf0e93
- SHA512 1fcb5513e94cac3057d5f8ac47d52315380b872bab1ee2ccc7621eb27112477d987561d90ff7d9fee771ecab57023e1eddfcd2617c7e06d70639c91b98c7e822
- SSDEEP 6144:2GZiXhtM716cs+zEkJo/ORMw5Qf2RSTIadDpwU5CAa:uhty+uo/OM2gTIadDha
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 276KB
- SHA256 05eddcf6ee5f9f5d2c5bed97a2e8919b10df8f1c4b28c752626335b594d1fd3a
- MD5 4f5f6b928f3701343253b0a9b2e30790
- SHA1 85a0abebf9ee55ed30bc7a6db733ec3b19120b85
- SHA512 62e0f2a44a672b422dbd954ca36731806e5c29ecc129eb5b2f127f515e35c8877b566b5daa58e94628c7123e569d8eb947657b198f12875a1f69e30520a1365d
- SSDEEP 6144:FGZiXhtM716cs+zEkJo/ORMw5Qf2RSTIadDpwU5CAa:3hty+uo/OM2gTIadDha
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 98KB
- SHA256 c5c8028d7331d8c3100450d93fa8f78273f929b5c0fa7a529bc7f5c891d4d96d
- MD5 84c9642505665a84f8e139da9e288c6f
- SHA1 661f25985ab098c96918d5049e91f5973a69f407
- SHA512 7f16a4d45e6490f4b192f335ab750c5d416c2039f606092df2dd4250151abaf988a1b5d976f28d0bcf91f145c9239c030422dc1db25da24aa16dc4a752ce7c8d
- SSDEEP 384:4JnUdxEQTV7d3Jek4uolHPpQpN1AylE8asALM3YDHtfXAU+byfnezX9qClvjbz8Y:4uiQuWFlIrrd3k3YXKKKg6lt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 94KB
- SHA256 c85798fef7b4585175a302396c5b1c1b7e3461dc7053d8249471bc3923961686
- MD5 18289c17745b7dd380c48e715ce90258
- SHA1 61944f74f62d0ea541216b81544d64f5a76b1eeb
- SHA512 cee8b586f81f5dab861468502d7508417ff600c2fb7768b183d512da4c8ca05f355834c0f59172b6a9aafc311095380e137a73983c689ad74f81075df73d82d1
- SSDEEP 384:SnUdxEQTV7d3Jek4uolHPpQpN1AylE8asAm3YDHtfXAU+bQnFX9qClvjbz8kX3lm:liQuWFyI3I3zYXKKKg6l6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58b87d.TMP
- Size 88KB
- SHA256 676e5b7ddda6bb78b8fe49606e0a5db75b876e740c6a8e128129d022bfb88fc2
- MD5 d4976a1442264a68c1bcccd780e433ea
- SHA1 e8dce766796fa77876d19dc3298cbfbff4b2bb2f
- SHA512 6892fa2541738639dcc2f690e15f4f08e4069a4e391bc98e1635fdb50c8a4c1476330a67970608349e5183be0a3402351606721a801acc521f4b869527109114
- SSDEEP 384:7nUdxEQTV7d3Jek4uolHPpQpN1AylE7sAm3YDHtf+U+bgFX9qClvjbz8kX3llvX5:MiQuWFOI3r3CMXKKKg6lP
- MD5 SHA1 SHA512 SSDEEP