Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
567s -
max time network
571s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
कर्मचारी के लिए एक्सएलआर-पेरोल समायोजन.html
Resource
win10v2004-20231215-en
General
-
Target
कर्मचारी के लिए एक्सएलआर-पेरोल समायोजन.html
-
Size
8KB
-
MD5
5cd1d76cf78f814bf1d5330cef8254c7
-
SHA1
e8e10a15ebe338b53c9ad96583e3806924b693b6
-
SHA256
db1a1f0f94e118af23a03fde3d45904e3ada4826b61e21be482ab1e4a790efe4
-
SHA512
2d56f827ada992aad007a9108fc1819d1fb733d0330f5653505f6149056d9fbdab6b4d8c2e965fad934a5fcc231768dba607216572b35d351d0768e0f14d4580
-
SSDEEP
192:gbcqnHiwiciHoYD0k80LT/E9ZhSGCax2tju:ghHiwiciIST//sgGCal
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507169336123786" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3016 chrome.exe 3016 chrome.exe 2796 chrome.exe 2796 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
pid Process 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe Token: SeShutdownPrivilege 3016 chrome.exe Token: SeCreatePagefilePrivilege 3016 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe 3016 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3920 3016 chrome.exe 20 PID 3016 wrote to memory of 3920 3016 chrome.exe 20 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 1452 3016 chrome.exe 86 PID 3016 wrote to memory of 568 3016 chrome.exe 88 PID 3016 wrote to memory of 568 3016 chrome.exe 88 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87 PID 3016 wrote to memory of 3368 3016 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\कर्मचारी के लिए एक्सएलआर-पेरोल समायोजन.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff960469758,0x7ff960469768,0x7ff9604697782⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:22⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5100 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4608 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5196 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5336 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5572 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3812 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5144 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3204 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:82⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3200 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5244 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4636 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5632 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3088 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4748 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3884 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4708 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=948 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4592 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4580 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4952 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3192 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=3772 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4604 --field-trial-handle=1860,i,12105309200658576074,6632606554018634409,131072 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\05164d79-3726-4826-9de0-0ed3b6e4281e.tmp
Filesize10KB
MD5e43b4190c943cce0fd232a0fb7e78936
SHA1fd1cbaadd31dcb02a85833aa4fb681596246f98e
SHA256f56a3f007377a89e6b49dffa8cb328b787a2f48fdfe7f1e79258b801d2aa740d
SHA512da0bf6d100df2e6b84c06b8af870413a08e70fc26c7ec885e5595680a7725331b55625ea46b25d0caaad97ad61ab8d492a51c65152daf94ab487bf44360e5745
-
Filesize
192KB
MD55036f7c363373f5d9cc2b6519806feae
SHA13caf2148a2eb7c82f9aff0f3a2f4594ee70327bf
SHA256715c5d3e3839c1b47c3008e8a89f929e60858ee379724a20775003c692e9fd6c
SHA5124661cd6fb02dccc48a42fe127b1e88f7e794cd4eb1d8a5a8f5075f772dad63211efa349bab579c5bb81bfb2c4b1be201c6725a56f617f8913a2235e3565fe645
-
Filesize
17KB
MD57916a894ebde7d29c2cc29b267f1299f
SHA178345ca08f9e2c3c2cc9b318950791b349211296
SHA256d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
SHA5122180abe47fbf76e2e0608ab3a4659c1b7ab027004298d81960dc575cc2e912ecca8c131c6413ebbf46d2aaa90e392eb00e37aed7a79cdc0ac71ba78d828a84c7
-
Filesize
16KB
MD512e3dac858061d088023b2bd48e2fa96
SHA1e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA25690cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
SHA512c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
-
Filesize
1KB
MD5c0c8422cac58dce4dcce294af37911c7
SHA1ada4c5274ff08ed3cf328a710904c4fc586846d4
SHA256b74307c666ba473d08d9e4941b5518fac1c1662ec31736f0d69adb2a76e5f203
SHA51256e5d16a8b61398ed6f7708197b63a0b2a4a9bf73064ee3ec97f214f8aa70cf165350c5abaa548a31f5f8c7617ae3d0b090e6b30a1e91905a573da5617fea9da
-
Filesize
2KB
MD5f7607637eda942148b430f8427cb9c52
SHA107eac1ef604dbc5662c6210ef2e503ec4e7cfdd4
SHA2562f88c43dac2e5b44ee6e8d37e279d9cddaa7274c3bf1338cd052510e213c98a4
SHA512e6a9d8dc453f5360dbda845b21014fe52f2edba3109f0ec920c603be98b683b55cdcfbbec74a1f246fe8cc52bf10787003900daf79298f3dfab512046fffd11b
-
Filesize
2KB
MD51e02a08e4e95b4e2940d7f966dc41654
SHA1db01ed9cf2f23821c5f44ebb1fb4a5fce7c5e04e
SHA2564cc258cf4309236a0a9c5791f0cf3d3c8d428168064815512d8f3b9a3074ede5
SHA512a509644c70680ebeeba22e9a2bdf416a64b6b4018a0a7c247e62d28dfe92ab50cb36155a71e56d1879003a4db81f047f448e01184fcfdafb8237febbeb153ab2
-
Filesize
168B
MD53cc596051f35bb015c8ae5fc745d7545
SHA1299b342997078ed94f65593a4fbae9232c94e396
SHA256e56529c0c08d58b538a1dc927e87375476fe5e9a8acba1542cb86ee3a8d866c5
SHA512b45f599fe295b3e54936168a781dd841300db9e0c77ae20a6677ca1967e56137dfcc8357c0c12107be6da31d3a4fd40b21e3e80ae3d7b9d53182b6eb41aaf65c
-
Filesize
456B
MD5dd7901a4a737f77ab8d6fdb6d396e05e
SHA145881ff0bbf82d5ed90e894307ac29a357023f35
SHA256056ac25b99779c6ffa96f820e3713b5ae5d29a5e4bfc07f04dce10ab60943525
SHA512d2da7350755179d81fbcc03bd6feb09402ec91980932e9610278d0009b8fd64b2bc2d69f545b33400203cbd5bf060385f4b1f00a2dc04c71fd42f9c59721e5a7
-
Filesize
2KB
MD5aacd95121399f9367ee5c3ca5c5c3d13
SHA16a6f0420ffd316bec1a0be8cd233fe726d528bdf
SHA256f8796998a9386b2b37c65f277f57d95fcba0b76b14432dd51275274872654197
SHA51233136dc333ded4734d841c81440a60c9ae543ea17fdeaf9dccc89428b7754dbd25404cb93d873666284730fd42f1733ca3e0e8702d1b2f536e7fa98368192b68
-
Filesize
4KB
MD503cad73f3b6ca6fc5c2094fec37b33c4
SHA1b924015559de42621d6fd20f8f288af451096fe8
SHA2562f742f2711b78f16033b1271d5bb18f25210eff7e5566d6c257ec075c79fbc67
SHA5125d3213a1d6236d8fbae456fc50466ec996aeb71220243424a5173ad566bcf58b9d126b935da28995100aa9161ac7f6d598e8314d7185fb07d9f4524e3af3477b
-
Filesize
4KB
MD59a2b6fcd3d6b8c8b4a9e7647db19e152
SHA15d5438975945a54b39c14958f5a4a174a4e2d710
SHA2568a57802dfe1bd6ec1a8caefb6bf10d6d1fb029b2eb3420ddb0bdd64e4dcac3b4
SHA5125235cc9a11c25afde041899685ebb7839ad30efc58b57e88af1c9f6951aa55adf7921b1a80c13a5315d9f92636e6dfdd07ff3fb7fb2d2c4ab5c31e0043fd6bbe
-
Filesize
4KB
MD51889f33982dacd3ec8fe44731af63a30
SHA19bd37bceb2d896c5f9dc6560a2125b99fb3124d6
SHA2562a8e346744de2c720f70438878f1b6b11d35fa621bb7b63868b301c4cd0557a4
SHA512bff8e9e2f0bd379cfad64eee650cc813061ab87eb73c56056674da60c34bfb4d9e59f20ff9993e4e6e771b4a9787070d6494f42238afe79acdd21782c2769f2c
-
Filesize
1KB
MD56312eb540fc40b2e6007ec0b73e547bc
SHA194a9c33f1406ec1b662523afbc45ed69dc401504
SHA25677a5e5954f878c5f0f54b04856c00e7bca3f3b8f189acfd430bf8011aa614368
SHA5129dc6b61a39d584e8c1cb46a2c35f944308febdb62cbe85c1b159befdb9b7efe863da64d8e07a94e18ef387e7540cd45c2e0353054de74fc9366ec3f47576d967
-
Filesize
1KB
MD5309c0acca54972190ef94c7f09ddcfcc
SHA1a25aed11670f54f3dfbf127a7f696abcb64861c3
SHA2566436455d0988112be8309a29e0d8e5b110755163e25adb69a831f92867d729d4
SHA51210f7900431f87d4cd0ca9c5074fbc91a9967572e96a205e816f7cc73c7754a576bfab01e1b6981968fc310cb6b22937c0fedd2f1c56e7f2cc9ac51ca84ca2576
-
Filesize
371B
MD5b4f565bc776b327ddf93e1883db83da5
SHA178337166a5b8f400877429e0f77862a8929fb4cc
SHA25644f4310cddad9ccbb3bfce92c0b17f7ccc583daf12506355a0d413273ffb584d
SHA512e7a747f29601079a9c169a829109a57dc66b5d5e6abe983a0ce997bd79993eabc79a50d619ae748aa69e89afc4882ecae526373523fe5d37ab791ced58b61801
-
Filesize
538B
MD50857dbb855240d4c61fc2ba91a5b9710
SHA1a766ca2cc3d810f5a0a63b94d2566b942300a021
SHA256141ead056741e626ccef1d5ca92ecbfc1209505270b335886d38fb3053471239
SHA5121439cb51d9c8c0899006f02f140560520519cf84d393be1ea26e2033d8c62b5591ad9e47daae345cd23764f6c5e62d6de49e58ef2a8154e9a1de3240a21ccc7b
-
Filesize
1KB
MD5ba0364c283bc87e6ed0a39e639ca39d2
SHA15ee8db652f84fd26f2caadfc614abab9c6a9886d
SHA2561932e43b36082a018e79d9c3354db942951d3f2caaa62d2d9611747e34e71bc4
SHA512da943f15c1f65bb7901c42a8e6d3ab6ffb16b6cada22691b30d12331085d1ca60d7531aa652056f65802875bb0a65418a056bc7c6df96f714d27357ddadb47e4
-
Filesize
1KB
MD5a269fb8ff5dfa624fa7dd0b034ff57af
SHA1ad6074e6709c8b249d6790dadabf653ffff058fc
SHA25638d863559473af59b8f9d614c42cb42d243f86241f9e7ac537c9290f7c4b7d2a
SHA512cfd244cbdf00f191e9a4e036b0a18e3196f1a0e278404a60a1166b0334f5314bf194ecc5b163f012b85cb724b3b18db995705832ff14ca51074d1f4c0a66b4cb
-
Filesize
1KB
MD59f77ede4b464a13bdfeecb70d62ebcc5
SHA1dbc0faa66cc78d5dbab1a2acd549da52ecb05380
SHA256078a8b3e022a1de69c68fce6ec052de6ced98b045389f3431574dd1cdaeda1af
SHA512b56731d636438b8a3a484c722b916c9101db87f9266eeac8f8a8b4953b6fc4ee60a86a64ce01acbb0c9c95ded5e3a0545fd6a0b986af868bf5787b964b2518c2
-
Filesize
2KB
MD5b81ebf64380b9de0d07bab2d76a3f69d
SHA1784f7c5ded92d6eb4f2d08cd06f2c380dc506b07
SHA256347ecb269cdb0e305d663b30f19870b887ca0eea9c9a915d9d5859105c804e3b
SHA5123f69a8329943fddc194e084603f2d259c0306f57097ff1189afdbb536da532f6772d94f82b6d913b241b640313dd61222369391be6aed124fa36644d8180b46a
-
Filesize
371B
MD5d09df9cdde77a76c0c99ff1ccfe9f6cf
SHA138b09fdd4ef3149e598289ceddc6cf209a3ae959
SHA256d03961406d72ee03577366db4fc46518d4f31cde3d581684c94e6d809e40d37a
SHA5122188518dc3be0acd65e4bc4af73b8c4d67548898c17c7b2a1f3d2500ca5163cce34054c673675d4ba9caec5121bb8920132e323455ca5ba2a501d029f98c0f8d
-
Filesize
2KB
MD52916097280cc317948944f3a2a6e8110
SHA1421bed499539e46cc5f5181c590597531bcfc077
SHA256f08d9fde55f3f9480b93f50f0c2820cdf1b1d8c1271d5f645aa1a8ef99a037cb
SHA51291a034930630c5a8d6646a68c97df36380cceb1bee410f3f4f9e27681b9c624368aeb7538b0b1882462c1299d103ba5fd1b7d14f703c92005be4756ef067824a
-
Filesize
10KB
MD58e6fbdfbfbe17b20e8b3dc4ecd5e3d2c
SHA119a6b766407bd80c28edcd06427a7aa04641d97e
SHA256baf93f6c9329b6329baa708d2a39b969f79ad401eeaacf4e9863939f36029ca0
SHA512d0c16188becbea2c40e17627aeb96354eafbf68bc2c69ec2ac30a64b6088bc0d16d41344b139b0c5af63f12a0b9a90ad5d12315c5af8e4af490327ac2828d10f
-
Filesize
10KB
MD526dc86279337bcea5db7f92563a41f89
SHA18bd83611a22e80454e6ba7c65989980879fae4fd
SHA256c12e880f818e42212c32526a7f5687fb93162bcb3a8243164b30bbe3f33cce7a
SHA5128e08a1d450bfcc3c4b90c25862885a7771bd05b325a3252f40f66a7edf2870e9536087f707bb6b7742ee05bde3a1d3087128602a490a326de9f8c9a3b891c804
-
Filesize
7KB
MD57894ed5680eefd5ea148bf26ae2f44c1
SHA1a56f4e9e8aac03b7b6cf48f8d8f2a51d82963ee7
SHA256669f10f3b720452691c7daa7c0e409cad0b06f38ad498c18d66d2c73e08674b7
SHA5126b5159b1ce267134949602e5dd951d1a6c31732d8759b059db234a85eef90d52a28782a09f7fd08dac4bd8862d123ee9fd70ebf67abc15e5b80592befe9ad521
-
Filesize
6KB
MD5a6c4ab6fd49cd5598047f1ceff834a21
SHA17fbf284bd6ba6da6c3d6cfea9e898103dcaf0636
SHA25642386e1943fe05d75878f9deab31dbc172f3e0d3bae20a1b99230c60eeced18e
SHA512ba3cbe420a5b3b3a1d0e7620a324c39fd8eeb889480997a329875884567861f6bc4dc008a39c53f2f268fa203042c9c9d0901d2b3ef356a01864e5fce2ba3fdf
-
Filesize
6KB
MD503f0e98a349c9bdd750aa479397d6305
SHA1e639aba393a0c8da35da6de27f8f99be65f8d714
SHA2567b7f637d5d43b4ef5d7df0ec22543c36ff57080517ec067d5c35327f5a720f75
SHA51288ca2f50c45c2c50f213ef96fe04fab1c501a6e186f5c9bf4e743c6f5a570d9e0507f6c309823a450e58ca818b17aa74d844a94ae6c3559fc1b0211adcf288a3
-
Filesize
7KB
MD5f81fe9efd80c417379a01caf4fe0dfbb
SHA1159141cdec81f1126b14084e959db2867b3c7d78
SHA256e3ef45f9375efea4781051d8f387c5f90bc35e0ecd84432d428ebec68e50bffa
SHA5120dc9f9d9d40d46840d5af0fb26b2c297fdfe659de444d1b43afb24f162761e584d5af5e55f0c2a20f46734f54c3930d71f67fb86d2d0d8bbf5657a27db6899b4
-
Filesize
6KB
MD53490d15b273c824937748e0f855efc50
SHA10cd8e115636176ea8fdd3481e137449f78db2cf1
SHA2566df03c256fda22ca0312cbeb26e9681e88dab1a71122c496d808208292163666
SHA512b39231264f9814f5cbf751c3efb5af697d31b51cd485997f25e4d22535295d68a15267bb0a9a15a13ff547f5837e05e58affadd124f9eaf7fcee21278a2198f0
-
Filesize
6KB
MD53433d852c23a3877ac11dcc0620f0096
SHA153557998cad5ec86d23358c50fb7ed19676b5a8e
SHA256c43778b17b4d2e8dbfafad5109bf88a4b4910529fb3853feb443642a57c64c64
SHA51265b296ef4f898f30d8f57f4180325c10625b2f86f904ae76305f495b85329c818d80a0505df4c4149a0d93c2d93c8721d8dc99dd37fc7a387a8d84a66bea6873
-
Filesize
114KB
MD5191f2b839f96da6a1f92e2779ec6928c
SHA1ba96ef9a04565cf8bc2da1384cf37e23f725a6e9
SHA256b9f799e6b79e7cefd0c6ba601da1de3ff0df68e6bc7d1b7ce4753609c615a4e7
SHA512e53301921faa1e5769e2fb1ab830e76c96a51662b6fa5516251ba353261d2b84c464cb18184d606aabb7ae1091d6f95cf04de0a6b772f13c3c37b0432bb93113
-
Filesize
114KB
MD50da2fabb75e34fef6d3c9373a3b990a5
SHA12df9134ed34cf75c68ed4ccb24c74b4f5d737506
SHA256578730eb872d80d9befdcf1555aa9e10d85004cdf5c0e1ea1cdb267e2415d268
SHA5123e783d3ff7b2984011f9766ffb0014560f51e4e13e509a66ffbe2602f334e6de12892e8d02c14920a7ea63c485d39dd9c5043f93f0a46fe2a95004139e29ba4b
-
Filesize
114KB
MD5b5504c415b0a05abfea5dc231418d014
SHA1df48ed144e1e6744ec1a7fc6b4e63cd555f83165
SHA25603122f4dd7423273e3f312f5f8c4a9f4e4635be163f7dc8011393c425e57eb82
SHA5123d76f1cb6c702f68394c829f9e6c48ef1df2377fde7fa7320c099efc593c1f0d99109b86fccc7c90d39c1a7889e53551fa670f8726463eb8afd627741bc53ff0
-
Filesize
102KB
MD594bf4e4ed50013eac9152446770050e5
SHA164d6e12512c95cc9270d7c6647837b7b98c48727
SHA2568bf9df5c97664e27fd812f0ec23ed3b7f2b943b5de530378169d5553bb97be3c
SHA5127d25936a8d85eb3acc04983ad237014b474aa1c7516ce882d44ccd71516461e9c76f60d1a9255ac0d167bda72ae25ba3da420b9241b4d65f175de80aafee1d3c
-
Filesize
99KB
MD54e105c4fe4fdf5c7b13e6aa65a0e8c93
SHA13224bdc9b7038c2a27a6751cb8c7cb4c8e30eedc
SHA2565c3045e0d0687546b74434285a9f7b4d2b253a9fac9d7ea76f2a357b24e65db4
SHA512c23849e3d3428326b2485c5e7cf9dace0dc0f4e076cb439f50e881f354d83ded8f6e314e9b8dcae2afe36e2c8bb252506adae33de973ec84b017fb44ff170b2e
-
Filesize
97KB
MD5ade06ef55fd8227f7056701f831dacc5
SHA1e25757301aa6952973869607c6d6654fa9269f6a
SHA256ee35c5fb1eb9304e896aa5724ebf09d85022d523fb9ae2ea7a8aaad143316310
SHA51292d2c026ba840ca3f62e76936e8c418b349bcd3b792c304831b1ff421dd5db5912133c9683704e82d6edaf1b7fef308e030b2d3e79d631a4d0ffc70a23103581
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84