6023ea55d3ff78b3642367375c276bbde744636c1d485b5bf7cf3d4609936bef

Resubmissions

12-10-2024 18:25

241012-w213zavare 7

12-10-2024 18:24

241012-w17t5ayfkk 7

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bios Flash Helper.exe
Size

6.5MB
MD5

ca968d3a6dea5e46716281ceb6cd575c
SHA1

792ef05b2262577e39b0c91d57874c2326ef0dc5
SHA256

6023ea55d3ff78b3642367375c276bbde744636c1d485b5bf7cf3d4609936bef
SHA512

b4b62663e9f08b29569cae12b8184366dd38004c574c3c33fe7a5859700277dc66f5d52184dd1a0d4ecac583909be10fe1f5bce250a86685b588edcea792035b
SSDEEP

196608:GPH+gp1DM9onJ5hrZER9xQ3jo4UR7+AkC2:WpNM9c5hlER9xA2RSA

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
5100	Bios Flash Helper.exe
5100	Bios Flash Helper.exe
5100	Bios Flash Helper.exe
5100	Bios Flash Helper.exe
5100	Bios Flash Helper.exe
5100	Bios Flash Helper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133732312063121972"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: 33	6552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6552	AUDIODG.EXE
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 5100	3644	Bios Flash Helper.exe	84
PID 3644 wrote to memory of 5100	3644	Bios Flash Helper.exe	84
PID 5100 wrote to memory of 1148	5100	Bios Flash Helper.exe	87
PID 5100 wrote to memory of 1148	5100	Bios Flash Helper.exe	87
PID 1148 wrote to memory of 3152	1148	cmd.exe	88
PID 1148 wrote to memory of 3152	1148	cmd.exe	88
PID 5100 wrote to memory of 1832	5100	Bios Flash Helper.exe	90
PID 5100 wrote to memory of 1832	5100	Bios Flash Helper.exe	90
PID 1832 wrote to memory of 3660	1832	cmd.exe	91
PID 1832 wrote to memory of 3660	1832	cmd.exe	91
PID 5100 wrote to memory of 2476	5100	Bios Flash Helper.exe	93
PID 5100 wrote to memory of 2476	5100	Bios Flash Helper.exe	93
PID 2476 wrote to memory of 3480	2476	cmd.exe	94
PID 2476 wrote to memory of 3480	2476	cmd.exe	94
PID 5100 wrote to memory of 2460	5100	Bios Flash Helper.exe	96
PID 5100 wrote to memory of 2460	5100	Bios Flash Helper.exe	96
PID 2460 wrote to memory of 4876	2460	cmd.exe	97
PID 2460 wrote to memory of 4876	2460	cmd.exe	97
PID 5100 wrote to memory of 1748	5100	Bios Flash Helper.exe	99
PID 5100 wrote to memory of 1748	5100	Bios Flash Helper.exe	99
PID 1748 wrote to memory of 436	1748	cmd.exe	100
PID 1748 wrote to memory of 436	1748	cmd.exe	100
PID 5100 wrote to memory of 2876	5100	Bios Flash Helper.exe	102
PID 5100 wrote to memory of 2876	5100	Bios Flash Helper.exe	102
PID 2876 wrote to memory of 720	2876	cmd.exe	103
PID 2876 wrote to memory of 720	2876	cmd.exe	103
PID 5100 wrote to memory of 3564	5100	Bios Flash Helper.exe	105
PID 5100 wrote to memory of 3564	5100	Bios Flash Helper.exe	105
PID 3564 wrote to memory of 2348	3564	cmd.exe	106
PID 3564 wrote to memory of 2348	3564	cmd.exe	106
PID 5100 wrote to memory of 5056	5100	Bios Flash Helper.exe	108
PID 5100 wrote to memory of 5056	5100	Bios Flash Helper.exe	108
PID 5056 wrote to memory of 4212	5056	cmd.exe	109
PID 5056 wrote to memory of 4212	5056	cmd.exe	109
PID 5100 wrote to memory of 812	5100	Bios Flash Helper.exe	110
PID 5100 wrote to memory of 812	5100	Bios Flash Helper.exe	110
PID 812 wrote to memory of 4752	812	cmd.exe	112
PID 812 wrote to memory of 4752	812	cmd.exe	112
PID 5100 wrote to memory of 2304	5100	Bios Flash Helper.exe	114
PID 5100 wrote to memory of 2304	5100	Bios Flash Helper.exe	114
PID 2304 wrote to memory of 4580	2304	cmd.exe	115
PID 2304 wrote to memory of 4580	2304	cmd.exe	115
PID 5100 wrote to memory of 1124	5100	Bios Flash Helper.exe	117
PID 5100 wrote to memory of 1124	5100	Bios Flash Helper.exe	117
PID 1124 wrote to memory of 3596	1124	cmd.exe	118
PID 1124 wrote to memory of 3596	1124	cmd.exe	118
PID 5100 wrote to memory of 868	5100	Bios Flash Helper.exe	120
PID 5100 wrote to memory of 868	5100	Bios Flash Helper.exe	120
PID 868 wrote to memory of 2168	868	cmd.exe	121
PID 868 wrote to memory of 2168	868	cmd.exe	121
PID 5100 wrote to memory of 372	5100	Bios Flash Helper.exe	176
PID 5100 wrote to memory of 372	5100	Bios Flash Helper.exe	176
PID 372 wrote to memory of 2044	372	cmd.exe	124
PID 372 wrote to memory of 2044	372	cmd.exe	124
PID 5100 wrote to memory of 4916	5100	Bios Flash Helper.exe	193
PID 5100 wrote to memory of 4916	5100	Bios Flash Helper.exe	193
PID 4916 wrote to memory of 3772	4916	cmd.exe	127
PID 4916 wrote to memory of 3772	4916	cmd.exe	127
PID 5100 wrote to memory of 1184	5100	Bios Flash Helper.exe	129
PID 5100 wrote to memory of 1184	5100	Bios Flash Helper.exe	129
PID 1184 wrote to memory of 700	1184	cmd.exe	130
PID 1184 wrote to memory of 700	1184	cmd.exe	130
PID 5100 wrote to memory of 1424	5100	Bios Flash Helper.exe	132
PID 5100 wrote to memory of 1424	5100	Bios Flash Helper.exe	132

C:\Users\Admin\AppData\Local\Temp\Bios Flash Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Bios Flash Helper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\Bios Flash Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bios Flash Helper.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1424
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:2636
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3256
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1212
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1780
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3776
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3724
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:2024
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1896
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1088
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1832
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3128
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1364
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3228
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1368
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4916
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3140
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2008
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3232
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:2984
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:2452
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4916
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4612
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3968
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:1116
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:3232
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4260
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4884
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5152
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5216
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5260
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5324
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5396
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5448
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5504
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5564
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5620
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5680
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5748
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5800
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5848
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5916
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5976
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6032
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6092
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4260
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5232
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5408
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:2276
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5724
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5752
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5844
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:5996
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:920
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4072
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6016
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4124
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:4072
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6260
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6312
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6368
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6412
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6496
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6528
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6616
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6664
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6736
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6792
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6852
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6896
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6976
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7028
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7092
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7148
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6280
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6472
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6628
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6820
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6896
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7148
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6280
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6748
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:6892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:6344
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7208
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7260
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7328
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7388
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    PID:7440
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff7060cc40,0x7fff7060cc4c,0x7fff7060cc58
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1976,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  PID:6836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2104,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:8156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3716,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5008,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4604,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5092,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4928,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3560,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:6288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4716,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4656,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5612,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5732,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5908,i,7724201042141831194,5667493781104066361,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:7436

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d

Filesize
17KB

MD5
45a2dde4b4a43c5bb297b1e9d2226f4b

SHA1
cca65cc2b7a6349feccf4b9b84272ab74c263254

SHA256
96d5001b0f74bf4fe9004eab6e5cd52be632e256ead91642303b049298b405a4

SHA512
45bec1fb8e59477cfdc217bbb989f5730e1bd2cfab89887e44480ca3635e73d1e9cbd3c9045db1f8d2ab02cda0299af14ec4d79c5273e6eafc280345fe9ecd90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
49db93f33213c99237ceb5388dbc222a

SHA1
49982aa238361ab42e75f3764d0743040bd0f3e4

SHA256
91b23e71b8ab7965f6b6044d2f402b5a0a42af1fc959cd32dc17f519fb7b1019

SHA512
0827a30a7dd384ac3686a0dc0db2be879146bc747fb83634bc04641f4d7830d43ae7fc33743c839810aa4bc0d5feb2e43c4cadd52d3360c354f47adeaf33f0dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
28bc36d62fdfb61a287f09dcc4625dee

SHA1
4d02e374981f23db8e6f6ebe6ca4c6d4d0c36f17

SHA256
8eff2369930162e4c120fb3438f6574fb62b521cdaf0a9d7eb1a012fa1480912

SHA512
ad42aca093d8a4ddf283a265d1038922569039b03c5911bca0eba099f72d47f2fbbcdf51f5b5c6e6026c61911ba6d720514ff49c685e9c0c6cf867863bfefd12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
2a7248773e6f9ffe293b6a7cd2d5f797

SHA1
bafa0c0eb487a9372d3b3af4f39a23f3c5e67e3f

SHA256
fb2f96717f388e4b129549cc1d2c7b749a7b169e138733c33df940b8e8c0b89f

SHA512
75aa103ab1d9ac1c62c91c5b138d6f5e90571101e55fe76103557f1f4b599e3a551930f5cceba4d5eef8fb9a1527be302399da4ba753e80844ecc2dbb586ba9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
bc3e3bc33b1edb0cb8abfc76db5b97e4

SHA1
b0adc1437bf499d6a68abceed32037411f492c5d

SHA256
b4741186cb8f233439a8eb962876d40fad73114cc858bda9652b8894ef8ad2c2

SHA512
f5bad4efa1cc1aee28bca4dfb5657dfffca34da07432da0faf882cd2c2a4081a53c97f82db8f529ceaecb1bb7ed1133240e84c36ebe2e20c1bc2ee7a88ba0ad7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
8ea6979c000de9834ccacc123f053186

SHA1
823a3b5abf038bc8e2a7572372b822ae941e0fbd

SHA256
6ecd30790a5c446845eaeb0c8f80fcf94ef0bd2d8e48314f0290b07ffbabd58e

SHA512
cc30a89088c2e540ce4fef52155d559d628a7613d23c8075be6c303337817be8929e4be0ad3b8abc649180dde2a9c214cc61fa3a7f8c5e5e687649272cfb9b49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
2d25ff1cd1f83d409290bd72cc36e867

SHA1
6d3cf713d58d2b5c88d3d757af368fd230d4be2c

SHA256
e41bc6172577e17590ed104b53dd254aceaf2881d12cb8b43dd312b3221a0b16

SHA512
01fd6acf970271714ff8e49fb0a0b48539ace872d37e4c48a3c559fe35b4a3818aff7087e481283418cd9120ae3524f26044f213dd6d1b87caeb0b0f17ab0aa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
19fccda7840c5b68f8dace7a9a3c4649

SHA1
d9431db542122c5a4b6bd17a80064e4510ed70dc

SHA256
c7f6b9501e123ded98ef96754ce42d74280eb2e1630cf1b4c339bf5f5c3dbd71

SHA512
ed1162ef6eb7631fb8b572adc8a2dca89930e32e4e01854c2bc84d8e5ecc68fea985e70bc28e1e6920547a6b317f788e11f1832174ce40e2ee00008ce7664cf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c4be8e1cf91de4437889749cf318bad0

SHA1
927b401d11d5fc38c07b202db5dd0a1b64ab456e

SHA256
3070fb8a4f6cde2e44231ed3be773c3132b902c16c6f867bc7ac919722c9c9e1

SHA512
692b85d3edc922c5b159fa6335854cd4c41094bcfba27157627be8ec9b7d8a6cdec6bda3f7ec552a4964dc83c5f70394939b4f9cad05f6974c91d670c50689f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c00317a503e392f21806d98a9d9a7a6e

SHA1
3c43b79c039b2784855d51cfc4759d08995eb7fb

SHA256
0f8054584055509cd6a7f5e01489491426a59811c6d9ea6b9eac9c27e5416710

SHA512
9d9a6c23f901b4bd651250e596d197c865e958c902362a36ebd3a9d5f7c5dfd195458e3c2a217dab4a0ea6d73ba3d12d2a7bea98e70c679eaec1a0c04d6d9e1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ae8cb15b011b97dd7d7910022339563

SHA1
4ca988f7995886bb1820bdccf3ba0608c6cda42a

SHA256
c918ba52aa977d4a9abe14410e39b0e90e4df36026fc73f438cbe6fa69d1ca75

SHA512
72dcda3e819d176a3d84367351a022eec88745b936aa0faed89429bb9aea341227f8adc68fbad0b933deab9f5c52ce5ac6f11da29db8d159a7d9afd688c215a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2c7574b8b65687cb9574e43a860d165c

SHA1
efbb563e7c065a1d85df96a199ddafa4e9b6d002

SHA256
93bf5f79c1309812586d4fd7b62c210c41c4416cb5b0989bf5e2289b64c3c45a

SHA512
2db51ef3e2e80f615b02f08bfd2df17be9fcd4e1f9b45c8964b337c5b80f08e4d299912f6b5c96ad5f1eecf8b76fd3898236d279bb6945965054f3c74e6b62b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
9fd98e0120702c12ace4ca8df689b29a

SHA1
a6237b96450eb0df8e7997efb73bd472cd129a54

SHA256
86fba45253af515a206360f78b3607c855e418c083efb75bfc21c74a8184179f

SHA512
2d782ca3f9425878be59295e6c8f211b2d9ee08c6120cfed8a0d365d7a2e20057e5c12285568ffb6a542c04715d6c71a45e03ec3036f80f36cf894a36100c4da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
353030c9a4d71f1035197141e48eb893

SHA1
4d8cad07169b2a26eb84069fd27fea3a2572c363

SHA256
a08135e2174127e5933ef96a61843946d9f35a18e3a88f0ff63fbb8e02a8398c

SHA512
e9a316d2656899a5d339da5f44e1700849a6e4f1fe278a1f24c1e604136ff09379a4f791bea4044636c6090e74ed3a144b512762738fcfcd1e7a6b41a3e42676

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
6d086153d339bd66bc6aef7850c2e363

SHA1
8c2bc684096cf723ee9cd1f02ba52242774728f5

SHA256
6f8649d1996c74bdf6064007c899d52a7a60192a2b4ae40a2547d22c00bb5a33

SHA512
e1230808d5e0986a0648032fdf00cdbb1e33d04f4bbbc629c850aa0433b31d2b8946cc02aeb442d243ca489742cd5508dab3733ee7fbb2e8a4b5a0864d4b18c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\VCRUNTIME140.dll

Filesize
91KB

MD5
7942be5474a095f673582997ae3054f1

SHA1
e982f6ebc74d31153ba9738741a7eec03a9fa5e8

SHA256
8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

SHA512
49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_ctypes.pyd

Filesize
123KB

MD5
b74f6285a790ffd7e9ec26e3ab4ca8df

SHA1
7e023c1e4f12e8e577e46da756657fd2db80b5e8

SHA256
c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

SHA512
3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_socket.pyd

Filesize
78KB

MD5
0df2287791c20a764e6641029a882f09

SHA1
8a0aeb4b4d8410d837469339244997c745c9640c

SHA256
09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

SHA512
60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\base_library.zip

Filesize
767KB

MD5
7ece4ca42658ba2a669af5ba31c127f1

SHA1
eec81105b210e4a2cf576c7438647d5df2aa6169

SHA256
5dcbab6e1b53994dc71aa9b91f16d686387ba3b63c3e6acdf0b6bdf611271986

SHA512
818d550ee80d02a928a849383f588ba3f4e8031a5e0f46eabc075cfc8b5833c802740e48a055bab700a7961059fe53eddb487b2f306333f0c9e89a53d6a0f110

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36442\select.pyd

Filesize
27KB

MD5
a2a4cf664570944ccc691acf47076eeb

SHA1
918a953817fff228dbd0bdf784ed6510314f4dd9

SHA256
b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

SHA512
d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

Download Submit