Analysis
-
max time kernel
159s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 13:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe
Resource
win11-20240508-en
windows11-21h2-x64
14 signatures
150 seconds
General
-
Target
865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe
-
Size
2.3MB
-
MD5
616822f4f0c5d48f8f2c329b4ce56132
-
SHA1
cce62e02b9289e70ce1f5d71e4dbe13ef81d2764
-
SHA256
865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1
-
SHA512
a1027bd3961c44a99a7091419634006f672c3d2e219040d56b8e288690bc67ecc6d9f4afe651214a7cb0f20781c27c9c4f107ebcf0826db22ca8558e743bd1de
-
SSDEEP
49152:gHwt1LmBV9EwJATusYf03CWjlaoEcU/DZkF/GPxj7:a/HATuPfmtlaoEc+uMF7
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/4728-2-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-4-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-5-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-6-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-7-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-8-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-9-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-10-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-11-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-14-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-15-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe behavioral1/memory/4728-17-0x0000000000A30000-0x0000000000F9C000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640549494433628" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 3440 chrome.exe 3440 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe Token: SeShutdownPrivilege 3440 chrome.exe Token: SeCreatePagefilePrivilege 3440 chrome.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe 3440 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 3440 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 93 PID 4728 wrote to memory of 3440 4728 865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe 93 PID 3440 wrote to memory of 4944 3440 chrome.exe 95 PID 3440 wrote to memory of 4944 3440 chrome.exe 95 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 3768 3440 chrome.exe 96 PID 3440 wrote to memory of 1136 3440 chrome.exe 97 PID 3440 wrote to memory of 1136 3440 chrome.exe 97 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98 PID 3440 wrote to memory of 4764 3440 chrome.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe"C:\Users\Admin\AppData\Local\Temp\865193b053c15163f5cd41f108a60ce240fe217d792f6e6b8077c3222aeb4cf1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd40079758,0x7ffd40079768,0x7ffd400797783⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:23⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:83⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:83⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2816 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:13⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2824 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:13⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4504 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:13⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:83⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1868,i,4188198787915843582,15522133438213823659,131072 /prefetch:83⤵PID:4156
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:3476
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD583b5a898be038b9e2ba979c8bdc60255
SHA143d3c047fbb7c0869a5a3bc927f957c1b1ed30ec
SHA256b83b42025a5c38cd3cac88ce9a806c03b9fdf14c5c3a1713a86f656bf2e76a9f
SHA51201816b0f18cf110a24fd1273a5fb0f10d128f0e400f1930c55a9185be085ef652fe4ef521e35337e7a335694b2ab52be8e3020475e3cb8f30631ab6a57ffc375
-
Filesize
1KB
MD5b943c47571d49cc013455267b345c125
SHA1ddb0c964044b3a5d36e209e8b6d550b601738e25
SHA256fd07beb51e3204d3a8f0c857cd37dae4a94684f623c172fba0b7a1731163cb90
SHA512ff5cd1f47006327f09257ccf85ef6aba2cdca50b555c18638927192ae5cb92a0e84e7bbe01f24aff2c01e67b620cbe8feab3632a40f27a717c655f20235d288d
-
Filesize
705B
MD5a3b107e972349ae5d51037ea91c8b1e5
SHA1f7c257c95ef7f3c61e4ead286d49951498ebc380
SHA256d24648e0a9387a38fa3965b27498628f513bf322e3d3b4d54e764b6c40c960e2
SHA5120bc8adb5dee29349688b930aced5b61c71bbe2fee3fa565bf743f71ed9d8474c2515894e72419570a560fc56ff7332b285cd84dfdf56bd9fc413efb58f15cba2
-
Filesize
6KB
MD5c16f5a0b0adc57b613853b3d0ebe15c5
SHA1a307c5733c037cda50ed8e45fa575a5cf31bbdd1
SHA25619a5026bb85e35e99511ee21e2a5220c45fa1265530ed221fe8c356a4bea0c83
SHA512ffb98897dbe65cf76b85ff238e4db3fcdf157d13c83dee3acef253f9f36a8f742d6a2b92916ccbdd33560a33f00d622aa4c31e0763fcd2db5d7be062bc57d367
-
Filesize
6KB
MD5547d1a4c96e3db58f079b8d264537de7
SHA109bd704263f74190c95a9e3b3b52caad46f28397
SHA256f61b35e05ca8116fef3b0c989863e24abd0d437168ab40fd5788ac250b8265bd
SHA512a6523f8973b1f2b6b836680e26dacfbb8293b512912898ff02a50cfca01a8f0835035ef3f6bf9ed77051451ab1af389ce40374d13366193006a1dbac5fa7ab2f
-
Filesize
6KB
MD542846a48f85b7356ecdd2c0d71ff5f57
SHA1f86cb426a5fe7b31ea88deb304b461329311202e
SHA2566b043adad3bfbaf7cfff0da0911e610aaf91b880f563e53edf9eeea63bfa529a
SHA512d987a2f9281aeea815b38b5030faa6bd359675a854a289744d7dad86122024d314f121d1e67225f6b1b7018b0940680e1ba617c2097435f1f49c1b95ad858962
-
Filesize
281KB
MD5fc36152952e8adaad4b20549f67a0f09
SHA17f0df90351cbf292cc0cc5bd250cc228f0eaae2b
SHA256ae0f4fc4373e01918c1caf52f9c19b3f5f29577922579c2ce3b434af0964a440
SHA512068c3910036516c1fd112a2f84ddd732f5f8e1e3ad7401dc310249e00a2b248642033d718d32434ae23cd32150c1b666d7d4e15c9862deaa9610fb5422be8d19
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd