Analysis
-
max time kernel
68s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7z2405-x64.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
600 seconds
General
-
Target
7z2405-x64.exe
-
Size
1.5MB
-
MD5
c73433dd532d445d099385865f62148b
-
SHA1
4723c45f297cc8075eac69d2ef94e7e131d3a734
-
SHA256
12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9
-
SHA512
1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447
-
SSDEEP
49152:ZEVAbJqaITViU3qLkr7toP9KT+uv6WC+5uxe1o58:ZEVcqeUaki9oBqt+
Score
7/10
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\History.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2405-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133633830877514640" chrome.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe Token: SeShutdownPrivilege 3944 chrome.exe Token: SeCreatePagefilePrivilege 3944 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe 3944 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 3656 3944 chrome.exe 83 PID 3944 wrote to memory of 3656 3944 chrome.exe 83 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 388 3944 chrome.exe 84 PID 3944 wrote to memory of 1988 3944 chrome.exe 85 PID 3944 wrote to memory of 1988 3944 chrome.exe 85 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86 PID 3944 wrote to memory of 1052 3944 chrome.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:1968
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb79b7ab58,0x7ffb79b7ab68,0x7ffb79b7ab782⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:22⤵PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2280 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4076 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4892 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4896 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3340 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4604 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1728 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4088 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:12⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 --field-trial-handle=1808,i,12842749040174467896,4081601322456818276,131072 /prefetch:82⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD53428b9967f63c00213d6dbdb27973996
SHA11cf56abc2e0b71f5a927ea230c8cca073d20fc97
SHA25656008756553ea5876fb8aad98f6f5dbca1ba14c5e53f4fa9ec318e355e146a7e
SHA512b876b39d030818ce7879eb9bb5ff4375712cf145b7457a815880bf010215bd9dcde539e7d0877c56558e0d23a310bc75bfb9d315f9966cbda4ae02a7821980cc
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5edadebf667aec9c2725564d6b63ffc83
SHA102760e4f18460ebede651dc1eb21bf59a41fd70e
SHA256352d5c3f38a1be6fead19f1cb5a367354cb86705f44f358fca00f13c4942e5f9
SHA51297080eab27fb01562d213e4bc2c04b859678c5893e9aeef0b41b416a1af42bb92b508658f1345992f89196b31b7bc8f6a71cdd0346e0e8caf6376dbba0ee863e
-
Filesize
7KB
MD5d51ef8d7113c583dc36e7ca519cadce5
SHA1dd522051405756f5581406fe604093c2477130cd
SHA256f0a880b2b0385bfa1111727625f29b4c8f16200475e1413c28817138b8574344
SHA512424ea26882e444809276a6b7e371da772cacff5a60e80d2f7bbbf4d3348f5dc34adfc7b1173684799b7b2e9d5f3d6971b425eadc61ed6076018ed961fcf080e9
-
Filesize
257KB
MD5c132fc2286b39fb59e9fad809af188e3
SHA1f723a257a327391fc595bc6edafbd97776914ba7
SHA2568c936ce6693b64839627ef7cf05a40bfb3813b770d4cfa16343e755103374618
SHA5124cd1960a939da0576505810e57c4075a11199bf29a74080490bd3db54f42f3bb7340d121468025ad01089e98e49f69dfb1e3937a8cb2a25b7eae08f5cac11754
-
Filesize
257KB
MD5f96227d9723b761187d560e96bcec820
SHA175ef981a651f6af37464c9c082f377809de34acf
SHA2567158baa133e1aaf242f43ffbd37aeea0f60c685d7e66a73505a9ab9f65415e2c
SHA512a30c69d6f7a2212b948258e89b1ea9c3bcc22bc1585bf35daff9dc4cf5a5f2fc041aa66a30d3e585269c224ff30436da0735332b7941a665b7e3da67ef6a24c8
-
Filesize
92KB
MD59573c89b98ae74c0a0e2d241308c4f33
SHA14dfb0647e31be072498a34003d1ed405eced77ac
SHA25624e8f7fb78f19077dda34a7dfcc660a115028213f04c6ea0cc627875b64a4c21
SHA5128a60447ffb64d8cf54d2e6c7f316c56e8ba65f6a4a09a983642e59d5787c8d550786a8818b8a73f70242214a5063cc0be974afcffd7ef3325f5aa29c8cf923e2
-
Filesize
89KB
MD5e62fdea9d2bf5ace61bab5dd760942b2
SHA16e57da9f03579290c1863682ab63f0fcac71ba9c
SHA256933734c682e436c7ecc89b7f1a84950bd26fa187a006f924e5dfb85bf1afa9e0
SHA5126d5693fb59f7ec99c722217d6c2ac4c2a7281d39137cffb34186f5b35ab7b62d74518140f792a0e70bb7c79f03850d3a2d7eb16aca2740368a78b85d8bc38387