Analysis
- user interaction
yes - max time kernel
94s - max time network
96s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 16:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://dice-checker.com
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
General
- Target http://dice-checker.com
- Sample260722-tyjcmscr3w
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3160 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292112864151904" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f0005398e082303024b98265d99428e115f0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f483accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000000384a9bbad0fdd014b8a8722bb0fdd014b8a8722bb0fdd0114000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3412 chrome.exe 3412 chrome.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 3412 chrome.exe 3412 chrome.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
pid Process 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe Token: SeShutdownPrivilege 3412 chrome.exe Token: SeCreatePagefilePrivilege 3412 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 3412 chrome.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe 5292 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 chrome.exe 5292 taskmgr.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3412 wrote to memory of 4816 3412 chrome.exe 88 PID 3412 wrote to memory of 3160 3412 chrome.exe 90 PID 3412 wrote to memory of 252 3412 chrome.exe 91 PID 3412 wrote to memory of 5144 3412 chrome.exe 92 PID 3412 wrote to memory of 252 3412 chrome.exe 91 PID 3412 wrote to memory of 5144 3412 chrome.exe 92 PID 3412 wrote to memory of 4208 3412 chrome.exe 94 PID 3412 wrote to memory of 4724 3412 chrome.exe 95 PID 3412 wrote to memory of 4208 3412 chrome.exe 94 PID 3412 wrote to memory of 4724 3412 chrome.exe 95 PID 3412 wrote to memory of 1708 3412 chrome.exe 96 PID 3412 wrote to memory of 1708 3412 chrome.exe 96 PID 3412 wrote to memory of 4588 3412 chrome.exe 97 PID 3412 wrote to memory of 3148 3412 chrome.exe 99 PID 3412 wrote to memory of 3148 3412 chrome.exe 99 PID 3412 wrote to memory of 5388 3412 chrome.exe 100 PID 3412 wrote to memory of 5388 3412 chrome.exe 100 PID 3412 wrote to memory of 5260 3412 chrome.exe 101 PID 3412 wrote to memory of 5260 3412 chrome.exe 101 PID 3412 wrote to memory of 808 3412 chrome.exe 102 PID 3412 wrote to memory of 808 3412 chrome.exe 102 PID 3412 wrote to memory of 1464 3412 chrome.exe 104 PID 3412 wrote to memory of 1464 3412 chrome.exe 104 PID 3412 wrote to memory of 5020 3412 chrome.exe 105 PID 3412 wrote to memory of 5020 3412 chrome.exe 105 PID 3412 wrote to memory of 4484 3412 chrome.exe 107 PID 3412 wrote to memory of 4484 3412 chrome.exe 107 PID 3412 wrote to memory of 3784 3412 chrome.exe 108 PID 3412 wrote to memory of 3784 3412 chrome.exe 108 PID 3412 wrote to memory of 5368 3412 chrome.exe 109 PID 3412 wrote to memory of 5368 3412 chrome.exe 109 PID 3412 wrote to memory of 4844 3412 chrome.exe 110 PID 3412 wrote to memory of 4844 3412 chrome.exe 110 PID 3412 wrote to memory of 2428 3412 chrome.exe 111 PID 3412 wrote to memory of 2428 3412 chrome.exe 111 PID 3412 wrote to memory of 2840 3412 chrome.exe 112 PID 3412 wrote to memory of 2840 3412 chrome.exe 112 PID 3412 wrote to memory of 1888 3412 chrome.exe 114 PID 3412 wrote to memory of 3108 3412 chrome.exe 115 PID 3412 wrote to memory of 4144 3412 chrome.exe 116 PID 3412 wrote to memory of 2172 3412 chrome.exe 117 PID 3412 wrote to memory of 4636 3412 chrome.exe 118 PID 3412 wrote to memory of 3612 3412 chrome.exe 120 PID 3412 wrote to memory of 4688 3412 chrome.exe 123 PID 3412 wrote to memory of 4688 3412 chrome.exe 123 PID 3412 wrote to memory of 2848 3412 chrome.exe 124 PID 3412 wrote to memory of 2848 3412 chrome.exe 124
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dice-checker.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe35e8c728,0x7ffe35e8c734,0x7ffe35e8c7402⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1420,i,6697965706552593326,6500847823293187157,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:112⤵
- System Time Discovery
PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,16891865841497073777,6954445407047193577,262144 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,6071467910829240331,7858375883402077038,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:132⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,11975825049725170759,16660018449719882532,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3064,i,290527143313356870,17934032146088749690,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,16673816695416581524,16980433288316307323,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,15823709014107780098,7949100733403769737,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:142⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5268,i,8509977206057908309,16787816368702385734,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5312,i,6584140811904508741,2258262973218173067,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:5388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5604,i,6072242007654343884,14735956753381871552,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:5260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,9404783452978659533,14046131336070884429,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5752,i,13631900271469870390,1205616566846269223,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5964,i,11679835370011313572,8240464783533568427,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:12⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6276,i,15817755323936342914,5028508151359996142,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:12⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5288,i,14821390150001115308,11114802659565020979,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6252,i,14559021605748478120,15415004106887209222,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5872,i,17370651125374163302,1805192352405735979,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6516,i,10722634680226120626,14085367801033653317,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:12⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5712,i,3103065643430399528,5248785921690806146,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:12⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,3502567167339595850,9166854164668333723,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:142⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,8650241829905096399,3793027967466790638,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:142⤵PID:3108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,9065534796113862053,3801700397099531997,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:142⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,11472610299012888558,6954503099412161412,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,11822116403504891391,4800702206766508323,524288 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:142⤵PID:4636
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\view-source_dice-checker.com.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6416,i,12573154290310249297,10536018130801905731,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:12⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6112,i,12501449193915837357,3360628062638447063,2097152 --field-trial-handle=2040,i,6527419056120073461,15951845983244921989,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:12⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:4852
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\45836846-7805-4c02-9fb7-52dd957fa50f.tmp
- Size 13KB
- SHA256 f4bda37833af952a47c8072a07bb0d55140f691ea264576ac6dfd8b0234ac0d9
- MD5 5d5a241363f1a2d872cda6ca93e58613
- SHA1 c41627981acfc2c9335e00d8814385f7460f928f
- SHA512 7ab6b05fe86641099ba7d0334a4ea39f8882b34a4e1f7d9f8e61040f4c000f16a0d20e362daa6abf5c9cd9bb328a43e7bbcf0f65891eeae77ffcd904df01da39
- SSDEEP 192:dRnS8b4oQv7Dv9PRp3ide6o964H4Db+WNrldGfCWdo11Ta/5dmBm2BnXi2W98kwh:dRnSexMHtXq4burrvuuovgm2BnS2RZwE
- TLSH T19152B62FA924397B6DCAC219F9217B67D7F5102265902E84F7FC8A2C16E7ACD2313013
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a5e7a9557a5d8407d347ef98077ad2748b51efc6c3836c7dd7b0ebd769919a1c
- MD5 23f995bbbb4c5f9dff313105957aff29
- SHA1 f64610881ec36de88d3b899df558c54ccf95b537
- SHA512 94a7bb112e0503739aa4e37327b760af4a614da7798b7a8eceb392068c161b12040c7f4bbde0c9914de47696d403f522a3bb006f75f489a0288098a0f07e9c22
- TLSH T18F518CF7C6E88A7D891516F4AB147E1BCE2D0A18432C3C66C8D4AF4B67E2871D21165E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 d13371bc0c108254c4552fc560e881ce3d8dce8b6a148788db48f9431d46c64d
- MD5 9af4e45e2a381cf17fcf51b9a1858020
- SHA1 6afecfd4408b5829bf1ec0226d97b947a16729e9
- SHA512 82a204f288b36cb09f01e2e0a0aba9de12e65e3489d18c2fc895b201ad96bbdb7dd930eade0abf20e749c09932d8112b8154ca890f8f49a35171a47c8d80b883
- SSDEEP 192:dRnSCb42zv7DvAPRp2ns964Hsb+WNnfC4a/26P2W98kwn0VyIsnAUge:dRnSArLH6XFbwqJ2Q2RHwe
- TLSH T1C832A43EB924797B6DCAC219F9217B53DBF5002265912E84F6FC8A2C15E7ACC6327017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 08d438743d264b7c079ff6384ec2a23d7c14573b8ade2ff22ce26ebaa5635b74
- MD5 2a2e492c9328073008ee0419665ab3a0
- SHA1 6070f2fe18860b0c070763b61f2ef3c86e6a68e9
- SHA512 5ee8f0f67182f5d0911188c9adcfa486e0b5364310221f1e3d96b7104ad0cbe7d69d6b1dd267ce68f7413731e396c9b6a3399f45a096b289f90162613c347b25
- SSDEEP 192:dRnSCb48Qv7DvAPRp2ides964H4Db+WNrldGfCWdo11Ta/2BOP2W98kw10VyIsnv:dRnSA1MH6X97burrvuuo2B82RVwE
- TLSH T12A42C63EA924397B6DCBC219F9217B67E7F5102265912E84F6FC8A2C15E7ACC6317013
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 28d3fff9cb4c36c0d6fbf96b6bd712bd2e6a2f05b02c7fdc18fb8edfb247e943
- MD5 a585207c7d87c03155ec3d16b943d426
- SHA1 2f94ba94327f14ae0acc09e8fe3f398cf6ccaf0d
- SHA512 1dab3519cf4817fc8e41605b24c1e8c1aaf42d5d2928927dc1b2ac69ce774bdb21711b7f78acd82c570b427a1dd42282bff4528993a97c4e0f7aa2dcb6c383e0
- SSDEEP 192:dRnS8b48Qv7Dv9PRp3ides964H4Db+WNrldGfCWdo11Ta/2BBi2W98kw50VyIsnv:dRnSe1MHtXq7burrvuuo2BM2RZwE
- TLSH T18652B63EA924397B6DCBC219F9617B67D7F5102265902E84F6FC8A2C16E7ACD2317013
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 76307e8adeb693e0170a525ab2450723c0b65ac93b8981c2a0541267e522c20d
- MD5 36536b51aa6345b99769849a163f9340
- SHA1 a1227c1cc7503809936849cfc8a672c235213e88
- SHA512 d75b5c6c96580a1b09c318d5d21c49c18df6be134acc7da3704f38e318b718d9f083718cb4591a8c146cf96946e43337d83e84a99136b0065282598697a581c5
- SSDEEP 192:dRnSCb48DPv7DvAPRp2ides964H4Db+WNrldGfCWdo11Ta/2B4P2W98kwn0VyIsR:dRnSA1DHH6X97burrvuuo2BW2RHwe
- TLSH T15742B63EA924397B6DCBC219F9217B67D7F5102265912E84F6FC8A2C15E7ACC6327013
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
- MD5 f1d1ecef56c7515367970c4fb9982059
- SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
- SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
- SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
- TLSH T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 a7f24f598634fb677569f71f9a1d9b34ee68c8b937ea451a51d10560fe007ed3
- MD5 7e909892920aa834fef38c11fd44c747
- SHA1 59f22faa5d31ede04df631a4ea7227fccef7bb07
- SHA512 438a3a5f73e693b627a6c0cca5b858fa8b3cda5bdad279ebc3d60b33988c1b28a55c9232d4f512d9a31583d7e62a3411ba476fbe19ec67b5b0987a66f3483c96
- SSDEEP 96:CbJ0d+cAOIt5aDVmufj7ZcfSl8h4otop5xwD9B6NPGGfv9JtFiO0AuSwBSDHd0jW:Ct0LA/TE570iU2QjePvjtFGSwBSDHdUY
- TLSH T1C5C12A71B86D6E775EF6A590F5467943CDB4A057AE226E8089ED0F0C02D75DC2383623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 37e90bac7d8bb66a4f9f4ac56308ae9caba4dde426d69dc199fbb6ce10637188
- MD5 0eba91ed8082d4050c314d1c55486dc3
- SHA1 421899fde58924b899ff103a582b8a9ae686179e
- SHA512 e219e35ed84c0175762d79ee3d3b79d08e162ba374fa63fd3c5067fcb96f2eaa2f1a933509d8459d5ee4356f51422c56dec7f52e014614419d64bb1269f2abde
- SSDEEP 96:CC0d+cAOIt5aDVmufj7ZcfSl8h4otop5xpD9B6NdGyv9JtFiO0AuSwBSDHd0j9I9:CC0LA/TE570iU27jew+tFGSwBSDHdUZu
- TLSH T1A7C13A71B8AD7EB76EF69590F5467943CDB4A057AE226E8089ED0F0C02C75DC2383623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 6ac98e639364af04b8bff055dd72a964ddb5d7837134e572e5fd7aee4d7a2af0
- MD5 9ab722b0af7df4638b586342ab627437
- SHA1 db772fc7e43a2b94151a029429e2dc086719254c
- SHA512 fdf1924220f045c3180b3285d3cd53d7d14f7fd509990a891388b59c39d31e59e801f6ffe6fa5008a828ee17a6adb018af98c98e2c14b2e5e26a80ad992327bf
- SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5xCD9B6/dGyv95SHhbb2Jv4a:gC0LA/TE57cDUDejUweSHhbKl
- TLSH T1D5A10971B4A85EB75DB9C584F4827E83CF68A117A9226E80D8DC1F0C11E71EC1382A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 ddf46bf12249a95f6205942560179f0d90ce770e8c8beeec483b2a47fc9f66be
- MD5 881f32dbd2f06600845196421680240c
- SHA1 76904d3ebd4c56e1942adc4c6994afdc1ca9ded7
- SHA512 33c7079a60c6e3a37c34514fc0e1dd6757c57ab5cc0a3b52173bee2bd13c7ed1510fc5b2568a6448ae0d9ba814683ef13149cdc1fa6bbb7d441311e82c72d69f
- SSDEEP 96:CbJ0d+cAOIt5aDVmufj7ZcfSl8h4otop5xwD9B6NPGGfv9JOQDHHRNC39ISyVNC4:Ct0LA/TE570iU2QjePvjOQDHHuCMJK
- TLSH T13EC1F7B5A46D6EAB4DFAA481F1033D438DA8901BAE257E44E9ED0F4C02D35EC5383927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\view-source_dice-checker.com.hta
- Size 21KB
- SHA256 2584d4da3ecf856babe31805966dc0a381ceae8258f3e53ea4546f7850791d37
- MD5 57648a89e75c526d4ec4c0b10b5e339d
- SHA1 f35fd98fa8b96dfe5027b748751795a93573989f
- SHA512 6dd7111316e2362449aff2144039c5ca2d26dc4d75e637d08b9bbac519b1af88b296a67753a30ba4595234ab7af1d4ce47eb2d75730b43a915666493cb31201c
- SSDEEP 384:mocgpbG3EXzlmv8dteOEj53nfsKJ6KU1TAzl6Ls:mocgpbg0O8ynfoKU1TAzl6Ls
- TLSH T1FEA2B7A1F8E1C5324AD2C6D6C6623E9DB0D44176C3B8147CBCAC4B8E879BF72599121F
- MD5 SHA1 SHA512 SSDEEP TLSH