Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 12:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0848881926f7d6d3f2e45bddadd49b0c.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0848881926f7d6d3f2e45bddadd49b0c.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 0848881926f7d6d3f2e45bddadd49b0c.exe
- Size 1.1MB
- Sample240614-p7317avglk
- SHA256 0db2df808eb03e0fb728d6943a3a038c8321a04e39f2722edf4149dcde0efe6d
- MD5 0848881926f7d6d3f2e45bddadd49b0c
- SHA1 a3d21c15e5243256967f36e1e18c1ea2d17400a9
- SHA512 d221578477e661669b0d4d78e220346c45e17937fca801af7a3c9218f881c802e45895307f01370427af9f9dff98bed49a68a899e7169b2e8434063bc2caceb4
- SSDEEP 24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8auJ2+b+HdiJUX:WTvC/MTQYxsWR7auJ2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 0848881926f7d6d3f2e45bddadd49b0c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628435586840210" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{9F96AB36-5270-47F7-A938-C47EAEC4BB56} chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2888 chrome.exe 2888 chrome.exe 4956 chrome.exe 4956 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe Token: SeShutdownPrivilege 2888 chrome.exe Token: SeCreatePagefilePrivilege 2888 chrome.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 2888 chrome.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe - Suspicious use of SendNotifyMessage 60 IoCs
pid Process 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 2888 chrome.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 4068 0848881926f7d6d3f2e45bddadd49b0c.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4068 wrote to memory of 2888 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 81 PID 4068 wrote to memory of 2888 4068 0848881926f7d6d3f2e45bddadd49b0c.exe 81 PID 2888 wrote to memory of 4636 2888 chrome.exe 83 PID 2888 wrote to memory of 4636 2888 chrome.exe 83 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 2952 2888 chrome.exe 85 PID 2888 wrote to memory of 4828 2888 chrome.exe 86 PID 2888 wrote to memory of 4828 2888 chrome.exe 86 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87 PID 2888 wrote to memory of 3920 2888 chrome.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\0848881926f7d6d3f2e45bddadd49b0c.exe"C:\Users\Admin\AppData\Local\Temp\0848881926f7d6d3f2e45bddadd49b0c.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1bc7ab58,0x7ffd1bc7ab68,0x7ffd1bc7ab783⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:23⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:13⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:13⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:13⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4560 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:13⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3420 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵
- Modifies registry class
PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵PID:1180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:83⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1860,i,16660490253186562412,9968745376890985201,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 4090da906537ecd382fd8b2c02693e7d07eb91a3cf214337fbba0dfae874464d
- MD5 0647ba452e5a491fbf509ea8e566053c
- SHA1 2a34bac96b3b6956bdf84564ebf133279d55ee99
- SHA512 ff0b36eb301155f406ae81efd4dc69ca68d942991561e44c9582376bca03cf7486ac447c57c8745c528a2a75667b8f7f24ba4a4f2718eee4768d4d9f8e24fafe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 ab142a40fc82c68dfe9016d5f6c32580ba044ccb33fcd826c9c83efc6ebff7f7
- MD5 4bf1c7825066cd061bdd288e13a82edc
- SHA1 a897df647b8383097f5526b1b9b192190e75b2c8
- SHA512 e16fd1fc140d31bc3cde6282a2a5dba6c2ce0e5897c6b3ebd77544cbf049fcb3a2e0080c09f08e6eb65be406ac2abba62afeff619df95c0399b6d0cecddbe421
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 cf63b1ae6ace5c8f71a24e74d1b317cd1a73540f1d2ca69744b096c501e1ec4a
- MD5 8b0d67290c60d439743a817cda479685
- SHA1 73c8655381ecff67c59e3328bf9adc59d05d06df
- SHA512 3144cb1e5a79e0c6422dc65044467d61d33049416c331d5f0491a7e3b6ae6967a63acc07781a6fed6cb012016febfbe4bd90cda18e6066ee6bcffec2805e3271
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 524B
- SHA256 8db7d76cb5451038cf82e922bc38088b8226e0819adc0bf012ca4ee8d96fef3d
- MD5 96fc18123efd74c0e478023c2dea33a3
- SHA1 5a4d727095d1d7dd1e510668d4c4ec8d462e2369
- SHA512 277bb41eb2da798cd5ab148ac5c9bccae856e390079e646f17930e236ad8615b29f89678b7f06d72ae5e1f703f6ca4fb1204869a3708d322bbfe20c206210e14
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 520B
- SHA256 ee53af20f9d9fe30012f85654f371dc549d2487583926cd95c24a35a102830c4
- MD5 1e71b0209bb9dce7a25933601a66abf5
- SHA1 ef2d6b8313e116ea012d92fbb623cda7871d28cf
- SHA512 cfb321a989e6b69a09819b83c3393d349307f7848df8dfbcd35e94b2a39034dcf3206110b4a07b57257eff10220102181ce610f765065b633107bcfca4c28cd3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 e55325fccbadfe37531d69ae63e6bc4f76e4912ac0f05b8fa73476136862d1c4
- MD5 378c7693d22d520811a2f4ce6886fba1
- SHA1 865843671440ccc23d76460a11eff5003582b72b
- SHA512 74f500a23d63d2eba00f8ec5ea028cfc5849f481757f5d358fe1dda06f660a11c69e6b809243751e1f9f1b4b3a964449dcc9b80e7d0522f4af688703cba354ad
- SSDEEP 192:6aE5Yg9oPukaJw8Dyh+FqBIoqIP5tjEsXtScR:6aE5YgWGddyquIoqQtIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 f751f16de91582dd1f2da6ed87f9a7a3a78d3cfe4e1f62a45456c724c906537e
- MD5 faf2455828b173e2b32ce9604988e8c9
- SHA1 da60101d961198ef3f63b68914fa82ce4e343cfb
- SHA512 14f74a7bfb642905d9e79051a9f159fcd2b9cadd12baee97ab6ac6c3718a8c6bce7a4437d4e9c7d9a8019de8d327158611853d1474326a4375c80f776b4c1fd7
- SSDEEP 384:f70j7pLhLcsBMKXKG1kXqKf/pUZNCgVLH2Hf9XarUD8HGhb70j:fAj7pLhL9eYKG1kXqKf/pUZNCgVLH2Hy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 276KB
- SHA256 7553e03157ccd41b644b75f13e04e6b1fd00ed89b598319ce9b3966ed49fcf02
- MD5 3542611f4bb23314a003125b048afe1b
- SHA1 3d6acc9db30eb1eb43e3ced005740990dfcb754b
- SHA512 9ea5fd0dd4829ee5a01379f5a051ef635bbee9366ba42c61f33a8e1bc1717eb9e28df8a8184a21b76e8e542e9524186ffdf866609ff7052c827028ca54246c8d
- SSDEEP 6144:1JoCNy8CgrK7m2RaTqmpkqYWvCxhIMw5Qf2RSTIadDpwU5CAV:1J5NygKDaTqxqYOCb2gTIadDhV
- MD5 SHA1 SHA512 SSDEEP