Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-06-2024 19:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sc.link/kGvSd
Resource
win11-20240611-en
General
-
Target
https://sc.link/kGvSd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637304346318045" chrome.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exechrome.exemsedge.exechrome.exepid process 5116 msedge.exe 5116 msedge.exe 3448 msedge.exe 3448 msedge.exe 3148 identity_helper.exe 3148 identity_helper.exe 1012 msedge.exe 1012 msedge.exe 2260 chrome.exe 2260 chrome.exe 1484 msedge.exe 1484 msedge.exe 1484 msedge.exe 1484 msedge.exe 5412 chrome.exe 5412 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exechrome.exepid process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
Processes:
msedge.exechrome.exepid process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of SendNotifyMessage 28 IoCs
Processes:
msedge.exechrome.exepid process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3448 wrote to memory of 5072 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 5072 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4268 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 5116 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 5116 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 2140 3448 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/kGvSd1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fad33cb8,0x7ff9fad33cc8,0x7ff9fad33cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11123007525464972485,499166184870475594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e866ab58,0x7ff9e866ab68,0x7ff9e866ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1848 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2128 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4228 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4428 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4536 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 --field-trial-handle=1788,i,3254137550476722431,1822762125292185467,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5b8dbbb61cc6ad0ea7c7ee74a5efd406f
SHA16b96f138541fcd7b109772919659e35a980946a0
SHA25612caddffdde89e2b4b2f34321cda490b57f276f388d42f2f9de7a94535d3769d
SHA512f455a3e4279401a2d9a8b16011dbbce6d16169c22ba35a640198430da6b512abf9db623c996585663fe048aac34714b65ed37a2a4b98c7ce83d87542c245da2b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD5c2ae29904925e53153343e4b95b0b5ce
SHA15c33e22ed71c5424646de6ae0b1338ab2b57d2b9
SHA2560b539572d2f0558304107fa80f5232fb66529d6d70e99bb4ed1cf3cc69a5da97
SHA51271fb0faec51afc060fca2273a5f8c980e4df47e6b3e9c21c40bb96a76e358aa439584755a6c1922a1e4797a2826aad911e258b4ff18bddf21a5c317ac0365572
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD582b5a054c4c4deafabba7b931924a42b
SHA175517def8e2e12ba6d38e32ec58b53433e737b9f
SHA25616035e4698405a14776d7e14e015010f208611fb2038cf05fd6a70ab233b24d2
SHA5121b737906ec961b5dad5fbc8d76c66506197a0f0bf6652022990ad691d4c3adbdd4e25a4dc3e571958cddb09634e2171c804b7d944b58862603ffeb5a773c8b09
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5da44c08256ddc9f562d35835eab71164
SHA157215a51602be976fe888b487975240cfff91c97
SHA2568a83f2089c29f47e6ba443ee5e93829333163c5b83c1231223fee26504ce8fc4
SHA512e9cc4ed8ad136a88bad64e120951456ba8d8bfa7265b0aff027ac81afe72f4abbc89faa895977586aabc76d2d3c3eaa598028a776a3b32c0ef5229695086e4d0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
280KB
MD5118d3dcaebceb4281033f6d8db60a504
SHA19221b4b1621817d5a394ff11d63279442b298ec7
SHA256811349983906b5912b1cb7d308257a0259538845ae15b230778c0cb61e139a10
SHA512c28fabf49eab700d77a5fb391eafecc7a432159027b436b83b2c58009df511453ef776ac60b5cca9c457a0e294653611282c67a2a1d2ba96b0619d44dff353f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56f738fcca0370135adb459fac0d129b9
SHA15af8b563ee883e0b27c1c312dc42245135f7d116
SHA2561d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63
SHA5128749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD568de3df9998ac29e64228cf1c32c9649
SHA1be17a7ab177bef0f03c9d7bd2f25277d86e8fcee
SHA25696825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43
SHA5121658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
576B
MD5061fccaa31b92633b875241f4a4e7bfb
SHA1fd38d4a0a1fbc4882731632801d6ce77efe23f1d
SHA2562d32f5c76956f946ebcab416758922de892ad43b41845a32fc3950135edfc155
SHA5120fa89e6922281b997a9a5cf9fa8a7b7f315919024fb838c5b25b30d51ee95d1e4f25f92011ef98f12bc093084e17514eac1de2d5a6ad16f8aa5fe214f20d18a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
480B
MD5ffd16d1483465239613c3d69dcae0395
SHA15270e18164336eb9f40870eb42081d59fa427e28
SHA256a6159071e29539072755a4c7ba6cbabab27e3c6fdf0f21d7f82148a213c4e505
SHA512812aac930f1351555a37a46198c719a3f8015cdd9fbb5bab10d1b58826b3d598e31a47c4c97efc4e1014673c4e1feb6f2d143a23ba5887ad0ed96d625cd4e038
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
996B
MD55e234d84dd8fe96cddb8a7a84cbb9be3
SHA144781cfc008e4fa6c631d73ed283f05f19c80921
SHA25606fae3151fdf66a3d9b3a19f4d154bc305c5ae8b7713f1a9da206097db787869
SHA512e6bb71e7c19cca0f978fe1fb69480591562d73bb51e90ed50d7036a30a3f66d06c4318e1d0295cf3c9749dd9a60c3d6b33e7633515f6043140027d6dab9c5110
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5669bfa743cb250af3389999216731807
SHA13642a367fc2ebd28b8a5b53d1940a983f93b8c2d
SHA256f19000c6738055037d0b30652dce8c2b25a778a3ff117726004efe36f32fcadc
SHA5129d237021199eb8e61cc4068ea2dc4ff18dd4a0d4cb5ddc691ca7659fac7f1f3f10adfa9c943263962693974bfed93f256b7ada466bd311c0997db3dd271fc74c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5791daa0c4c72dc414f91783ef5939018
SHA1f95d85065a38228b342bef3e5f871512c7cef36e
SHA256ac3a621626ef7c9387eeeafe88cd0c275f1bc8d9a73eec8c70649a77edf43950
SHA5121f2e87fd8b8e5e21b132b604834452a15bda424a29edd9de54f3acf9da21d3afac9354728f2dd6247cfa925b865d4886e70e5fd618e52d261ec15e638d9e49c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5261c65e06fbcc57d46f5ff3e70bdc277
SHA16c858bd9c3d792b5422f52611295ee3109a9510e
SHA256284114c39724cd39dcc1fd8fef12272f8ff4f86490a7d846a81c317e22a07bff
SHA512ef0f9b73bcca113b0b18e6a4bcd01dbeb080e39c3a49babd7185b6e9d53450009e6994a6f29cfb87472c68a4e2f50fc201bba3bd2bcc80b1a28d27ab0c9d6b0a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD548c8ab4826470142aaec4d1686e136a7
SHA1e5e13e586cb27e1d948d2db6c06c9ac8c69d8007
SHA2567aa16fce425cf68dbe5c17e88216189aba1094ec5a83d277ddee308ad02a1a17
SHA5120bf32fc791a1f27295f1a2b3a70ff0bc71dc97cf324d35ae85d53e5810b8aa40f11a90549144a6ee244d093502a4fc030dea7eb26cae74bf16b222467f9af2b0
-
\??\pipe\LOCAL\crashpad_3448_ZURIGIAOXSVBZQDLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e