Analysis
- user interaction
yes - max time kernel
982s - max time network
984s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 00:36
General
- Target 20260903201023-f2cdae11e7-track-1-consolidated-2_bs6stem_mt_0_piano_[mvsep.com].flac
- Size 134KB
- Sample260905-ax4gmsbb22
- SHA256 c17b17783e56ed2542eac2a33e9b92c5741de7fcd0544ccdb18a4f45b0e4941c
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 52 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 38 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\20260903201023-f2cdae11e7-track-1-consolidated-2_bs6stem_mt_0_piano_[mvsep.com].flac"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd16a0c728,0x7ffd16a0c734,0x7ffd16a0c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,3133185777296705542,17811539751943461205,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,6897941700211995197,9094262619709322810,262144 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,7603737415057675751,8912241715593546013,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,12988902071671887699,17224353349336147488,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,11232662760525051274,13388562502027141688,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,7520492786917301748,11843148882955998131,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,11466559185277741942,11369533270760649246,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,2018952099211176503,9612309575088555406,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5376,i,11620968494457280678,678755994206557327,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5412,i,5269757590149427805,73842356500887725,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5592,i,6887049640342242689,7224272959912216540,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,15980622026818528726,10904160583876380538,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5696,i,8017057370849040648,4861570162594250733,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5736,i,16079576055917264213,14672181981333749453,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5492,i,4611247483761322428,8434836966435898835,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5744,i,10058588953480726532,12168940129958210793,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5396,i,14061282756601080419,2583382694202043563,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,159487152689862443,7183104391146507216,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,3776758980807174316,17911600340410785032,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4560,i,8904632710069516612,10639270736222313684,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5972,i,4078269255969297609,5519508043536740641,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6004,i,13999452133031888849,17067197850754873143,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5528,i,7646864162928002849,8003343820101552499,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6444,i,16180794836403997262,3768189223282213338,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3720,i,14350942836790645594,14103653551045439593,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:144⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3728,i,2418071878788467982,1508692777827351169,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:124⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6096,i,11698654221841117290,3300709680258631308,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6148,i,2640871587033502072,3646809026114247286,2097152 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,3215782759349579300,5670719568130666511,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,2310026630395904762,2965817578547486790,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,16788060491520542869,4012941050404198973,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5984,i,12742962753417644223,17887862874776305090,262144 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6500,i,10646913011825467756,4026203780498880582,524288 --field-trial-handle=1984,i,6072114854152550593,15104482506121734389,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:144⤵
-
-
-
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F81⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
temp-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
LOG.old
LOG.old
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
67a473248953641b_0
67a473248953641b_1
the-real-index
the-real-index
the-real-index~RFe6501f0.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
prep_Activatable Class_Hermes_perf.cache
messages.json
default.exc
memory/1748-2560-0x0000012419D80000-0x0000012419E80000-memory.dmp
memory/1748-1354-0x0000012401950000-0x0000012401970000-memory.dmp
memory/1748-1362-0x0000012401D10000-0x0000012401D30000-memory.dmp
memory/1748-1347-0x00000124001E0000-0x00000124002E0000-memory.dmp
memory/1748-1393-0x00000124140D0000-0x00000124140F0000-memory.dmp
memory/1748-1355-0x0000012401D70000-0x0000012401E70000-memory.dmp
memory/1748-1349-0x00000124001E0000-0x00000124002E0000-memory.dmp
memory/4180-25-0x00007FFD1D740000-0x00007FFD1D774000-memory.dmp
memory/4180-36-0x00007FFD0BEB0000-0x00007FFD0BF98000-memory.dmp
memory/4180-367-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-35-0x00007FFD096B0000-0x00007FFD09946000-memory.dmp
memory/4180-38-0x00007FFD1C860000-0x00007FFD1C8A1000-memory.dmp
memory/4180-39-0x00007FFD155D0000-0x00007FFD155FF000-memory.dmp
memory/4180-40-0x00007FFD1A530000-0x00007FFD1A548000-memory.dmp
memory/4180-41-0x00007FFD155A0000-0x00007FFD155C6000-memory.dmp
memory/4180-42-0x00007FFD15570000-0x00007FFD1559D000-memory.dmp
memory/4180-43-0x00007FFD16780000-0x00007FFD1679A000-memory.dmp
memory/4180-1-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-2481-0x00007FFD1D740000-0x00007FFD1D774000-memory.dmp
memory/4180-2483-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-2480-0x00007FF786320000-0x00007FF786418000-memory.dmp
memory/4180-45-0x00007FFD15530000-0x00007FFD15541000-memory.dmp
memory/4180-34-0x00007FFD0E680000-0x00007FFD0E752000-memory.dmp
memory/4180-44-0x00007FFD15550000-0x00007FFD15561000-memory.dmp
memory/4180-48-0x00007FFD14300000-0x00007FFD1434F000-memory.dmp
memory/4180-46-0x00007FFD094A0000-0x00007FFD096AB000-memory.dmp
memory/4180-51-0x00007FFD128D0000-0x00007FFD128EB000-memory.dmp
memory/4180-47-0x00007FFD10860000-0x00007FFD108F8000-memory.dmp
memory/4180-52-0x000002578A6F0000-0x000002578A79D000-memory.dmp
memory/4180-54-0x00007FFD036B0000-0x00007FFD038F5000-memory.dmp
memory/4180-50-0x00007FFD0BE00000-0x00007FFD0BEAB000-memory.dmp
memory/4180-53-0x000002578A7A0000-0x000002578A819000-memory.dmp
memory/4180-49-0x00007FFD128F0000-0x00007FFD12915000-memory.dmp
memory/4180-37-0x00007FFD0BAD0000-0x00007FFD0BBB3000-memory.dmp
memory/4180-32-0x00007FFD1C8D0000-0x00007FFD1C8E4000-memory.dmp
memory/4180-33-0x00007FFD1C8B0000-0x00007FFD1C8C1000-memory.dmp
memory/4180-31-0x00007FFD09950000-0x00007FFD09CE0000-memory.dmp
memory/4180-0-0x00007FFD0B82D000-0x00007FFD0B82F000-memory.dmp
memory/4180-28-0x00007FFD221D0000-0x00007FFD221E9000-memory.dmp
memory/4180-29-0x00007FFD1C920000-0x00007FFD1C942000-memory.dmp
memory/4180-30-0x00007FFD1C8F0000-0x00007FFD1C91B000-memory.dmp
memory/4180-27-0x00007FFD223F0000-0x00007FFD22401000-memory.dmp
memory/4180-24-0x00007FF786320000-0x00007FF786418000-memory.dmp
memory/4180-23-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-18-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-17-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-16-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-15-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-13-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-14-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-10-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-11-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-12-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-9-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-8-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-7-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-6-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-5-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-4-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-3-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/4180-2-0x00007FFD0B580000-0x00007FFD0B836000-memory.dmp
memory/5896-1513-0x000000000B1A0000-0x000000000B3FF000-memory.dmp