Overview
overview
4Static
static
3Graillon-F...de.pdf
windows10-1703-x64
1Graillon-F...de.pdf
windows11-21h2-x64
1Graillon-F...et.pdf
windows10-1703-x64
1Graillon-F...et.pdf
windows11-21h2-x64
1Graillon-F...on2.so
windows10-1703-x64
3Graillon-F...on2.so
windows11-21h2-x64
3Graillon-F...n 2.so
windows10-1703-x64
3Graillon-F...n 2.so
windows11-21h2-x64
3Graillon-F...n 2.so
windows10-1703-x64
3Graillon-F...n 2.so
windows11-21h2-x64
3Graillon-F....0.pkg
windows10-1703-x64
3Graillon-F....0.pkg
windows11-21h2-x64
3Graillon-F....0.exe
windows10-1703-x64
4Graillon-F....0.exe
windows11-21h2-x64
4$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PROGRAMFI... 2.dll
windows10-1703-x64
1$PROGRAMFI... 2.dll
windows11-21h2-x64
1$PROGRAMFI... 2.dll
windows10-1703-x64
1$PROGRAMFI... 2.dll
windows11-21h2-x64
1$PROGRAMFI...64.dll
windows10-1703-x64
1$PROGRAMFI...64.dll
windows11-21h2-x64
1$_26_/Aubu...64.dll
windows10-1703-x64
1$_26_/Aubu...64.dll
windows11-21h2-x64
1$_27_/Aubu... 2.dll
windows10-1703-x64
3$_27_/Aubu... 2.dll
windows11-21h2-x64
3$_28_/Grai...64.dll
windows10-1703-x64
1$_28_/Grai...64.dll
windows11-21h2-x64
1Graillon-F...e.html
windows10-1703-x64
1Graillon-F...e.html
windows11-21h2-x64
1Resubmissions
07-07-2024 20:29
240707-y91taaxgjk 407-07-2024 20:21
240707-y48lyaxflq 420-04-2024 11:56
240420-n355bagg7x 4Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-07-2024 20:21
Static task
static1
Behavioral task
behavioral1
Sample
Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Graillon-FREE-2.8/Graillon Datasheet.pdf
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
Graillon-FREE-2.8/Graillon Datasheet.pdf
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/AuburnSoundsGraillon2.so
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/AuburnSoundsGraillon2.so
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST2-FREE/Auburn Sounds Graillon 2.so
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST2-FREE/Auburn Sounds Graillon 2.so
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST3-FREE/Auburn Sounds Graillon 2.vst3/Contents/x86_64-linux/Auburn Sounds Graillon 2.so
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST3-FREE/Auburn Sounds Graillon 2.vst3/Contents/x86_64-linux/Auburn Sounds Graillon 2.so
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
$PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/x64/Auburn Sounds Graillon 2.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
$PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/x64/Auburn Sounds Graillon 2.dll
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
$PROGRAMFILES64/Common Files/VST3/Auburn Sounds Graillon 2-64.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
$PROGRAMFILES64/Common Files/VST3/Auburn Sounds Graillon 2-64.dll
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$_26_/Auburn Sounds Graillon 2-64.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
$_26_/Auburn Sounds Graillon 2-64.dll
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$_27_/Auburn Sounds Graillon 2.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
$_27_/Auburn Sounds Graillon 2.dll
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$_28_/Graillon 2/Graillon 2_x64.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
$_28_/Graillon 2/Graillon 2_x64.dll
Resource
win11-20240704-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Graillon-FREE-2.8/license.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
Graillon-FREE-2.8/license.html
Resource
win11-20240704-en
windows11-21h2-x64
General
-
Target
Graillon-FREE-2.8/license.html
-
Size
5KB
-
MD5
6c32024856003d2fa55133b17b6c7cde
-
SHA1
d12d861c31d0e9620f3bfb521e0280b6099ced2b
-
SHA256
9145868c8fa75bdb51f30e7b81ff941737ccd9d7535d0a4e5ca3bdb9da2686d3
-
SHA512
dfbaec21f86870b2822e3bf44bf54c371cd6ddd67875b901d2575a0c7ebfa506dcba4ae022e4ad286f28c88672ac1fb252771b1d3f4f977f8151b36dc19183f5
-
SSDEEP
96:4U2VNNT8OwnR7XVUNAjzbdZnLtm5EitdgZX5/+8vPQXn1Zro9/HWh:4n3cnR7lcAjPtmCZXYIYXXo9U
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133648575374082558" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1300 chrome.exe 1300 chrome.exe 796 chrome.exe 796 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1300 chrome.exe 1300 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe Token: SeShutdownPrivilege 1300 chrome.exe Token: SeCreatePagefilePrivilege 1300 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe 1300 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1300 wrote to memory of 4116 1300 chrome.exe 81 PID 1300 wrote to memory of 4116 1300 chrome.exe 81 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 5112 1300 chrome.exe 82 PID 1300 wrote to memory of 2800 1300 chrome.exe 83 PID 1300 wrote to memory of 2800 1300 chrome.exe 83 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84 PID 1300 wrote to memory of 4056 1300 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Graillon-FREE-2.8\license.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0x90,0x10c,0x7fffb0e3ab58,0x7fffb0e3ab68,0x7fffb0e3ab782⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1496 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:22⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:82⤵PID:2800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:82⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:12⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:82⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1868,i,4697145312104576019,5982911273332975615,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:796
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55dc2e76dfe35720db83a8a0d5ae2142d
SHA1d361b9cee026188f38bc6e18702b6401c1a0fba3
SHA256c9cdc802f6885457986accf5551593c52b7b2e9adf50914e96ac5d33fdd8f135
SHA5125d491d6f06c4644d98ca50ffb97b3e011ab12ae851a873e869c6a5aade27df747e0fa2b3013ee85d25ecdaffaa3eef6317d2430e40619e783324c4a7f6e58b2c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5c087d5c050b645154713099a82c08b8a
SHA16d9ce7a6784c92e72d8a34b5aa6c4eb877460979
SHA2566a3ceca8195064922286b8f61bb8804498f991d1757c84755a5ff99101753bd8
SHA512fd8f785bc6bb46067a5a2634a30fd6139dfbb73f9fae30d0db0bc90164fca5fbef2640b5149dc70ce74ff6202eb5c2fc5f7089527741d71fba740563d6e3a5bd
-
Filesize
144KB
MD5bcbdf27172e46921a3be80ee9ce1db4c
SHA1a2d61efb2b9fee992a6b59cf118f66faff27e8e7
SHA256b8f6b939064dd3aa7b29fc6eaf718affed80cbd026720cdd73e058b786e88ac4
SHA5127816776af64380cba33d213b1a97b871d5309f30dc481fa421a3ae31d911437e4b2e4662401c90779fa632bb4f962c5314243c9e6542031511e3e358512aaf79