Overview
overview
7Static
static
3ArenaWarSetup.exe
windows7-x64
7ArenaWarSetup.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3ArenaWarSetup.exe
windows7-x64
7ArenaWarSetup.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows7-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
156s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
ArenaWarSetup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ArenaWarSetup.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ArenaWarSetup.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ArenaWarSetup.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
d3dcompiler_47.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
ffmpeg.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
libGLESv2.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
swiftshader/libEGL.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
swiftshader/libGLESv2.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20231215-en
General
-
Target
ArenaWarSetup.exe
-
Size
139.9MB
-
MD5
3e202bb9a1dd5a69f26a924287ae21c9
-
SHA1
28ae516f8e784ac8a3e91a3deed9f1c7c1393a98
-
SHA256
d455f3a0b04ba38c2e18098a5705724d9c20f0a16511a82927f7e9a6cff344c7
-
SHA512
daeac00c25cc7cb204b9ca66689da547ce66766191f3acf90dcbc6ff5b5d9a1d42c0b4fed93091d0c2a396365c059da20d8f95578fbb831697a4e400f7fc626e
-
SSDEEP
1572864:k2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:baodJFek8+k
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\International\Geo\Nation ArenaWarSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\International\Geo\Nation ArenaWarSetup.exe -
Loads dropped DLL 2 IoCs
pid Process 2372 ArenaWarSetup.exe 2372 ArenaWarSetup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsBootManager = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsBootManager.exe" reg.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io 3 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1864 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1564 tasklist.exe 620 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2372 ArenaWarSetup.exe 2372 ArenaWarSetup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2372 ArenaWarSetup.exe Token: SeShutdownPrivilege 2372 ArenaWarSetup.exe Token: SeDebugPrivilege 620 tasklist.exe Token: SeShutdownPrivilege 2372 ArenaWarSetup.exe Token: SeShutdownPrivilege 2372 ArenaWarSetup.exe Token: SeIncreaseQuotaPrivilege 1500 WMIC.exe Token: SeSecurityPrivilege 1500 WMIC.exe Token: SeTakeOwnershipPrivilege 1500 WMIC.exe Token: SeLoadDriverPrivilege 1500 WMIC.exe Token: SeSystemProfilePrivilege 1500 WMIC.exe Token: SeSystemtimePrivilege 1500 WMIC.exe Token: SeProfSingleProcessPrivilege 1500 WMIC.exe Token: SeIncBasePriorityPrivilege 1500 WMIC.exe Token: SeCreatePagefilePrivilege 1500 WMIC.exe Token: SeBackupPrivilege 1500 WMIC.exe Token: SeRestorePrivilege 1500 WMIC.exe Token: SeShutdownPrivilege 1500 WMIC.exe Token: SeDebugPrivilege 1500 WMIC.exe Token: SeSystemEnvironmentPrivilege 1500 WMIC.exe Token: SeRemoteShutdownPrivilege 1500 WMIC.exe Token: SeUndockPrivilege 1500 WMIC.exe Token: SeManageVolumePrivilege 1500 WMIC.exe Token: 33 1500 WMIC.exe Token: 34 1500 WMIC.exe Token: 35 1500 WMIC.exe Token: SeIncreaseQuotaPrivilege 1500 WMIC.exe Token: SeSecurityPrivilege 1500 WMIC.exe Token: SeTakeOwnershipPrivilege 1500 WMIC.exe Token: SeLoadDriverPrivilege 1500 WMIC.exe Token: SeSystemProfilePrivilege 1500 WMIC.exe Token: SeSystemtimePrivilege 1500 WMIC.exe Token: SeProfSingleProcessPrivilege 1500 WMIC.exe Token: SeIncBasePriorityPrivilege 1500 WMIC.exe Token: SeCreatePagefilePrivilege 1500 WMIC.exe Token: SeBackupPrivilege 1500 WMIC.exe Token: SeRestorePrivilege 1500 WMIC.exe Token: SeShutdownPrivilege 1500 WMIC.exe Token: SeDebugPrivilege 1500 WMIC.exe Token: SeSystemEnvironmentPrivilege 1500 WMIC.exe Token: SeRemoteShutdownPrivilege 1500 WMIC.exe Token: SeUndockPrivilege 1500 WMIC.exe Token: SeManageVolumePrivilege 1500 WMIC.exe Token: 33 1500 WMIC.exe Token: 34 1500 WMIC.exe Token: 35 1500 WMIC.exe Token: SeIncreaseQuotaPrivilege 1864 WMIC.exe Token: SeSecurityPrivilege 1864 WMIC.exe Token: SeTakeOwnershipPrivilege 1864 WMIC.exe Token: SeLoadDriverPrivilege 1864 WMIC.exe Token: SeSystemProfilePrivilege 1864 WMIC.exe Token: SeSystemtimePrivilege 1864 WMIC.exe Token: SeProfSingleProcessPrivilege 1864 WMIC.exe Token: SeIncBasePriorityPrivilege 1864 WMIC.exe Token: SeCreatePagefilePrivilege 1864 WMIC.exe Token: SeBackupPrivilege 1864 WMIC.exe Token: SeRestorePrivilege 1864 WMIC.exe Token: SeShutdownPrivilege 1864 WMIC.exe Token: SeDebugPrivilege 1864 WMIC.exe Token: SeSystemEnvironmentPrivilege 1864 WMIC.exe Token: SeRemoteShutdownPrivilege 1864 WMIC.exe Token: SeUndockPrivilege 1864 WMIC.exe Token: SeManageVolumePrivilege 1864 WMIC.exe Token: 33 1864 WMIC.exe Token: 34 1864 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 ArenaWarSetup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2976 2372 ArenaWarSetup.exe 28 PID 2372 wrote to memory of 2348 2372 ArenaWarSetup.exe 29 PID 2372 wrote to memory of 2348 2372 ArenaWarSetup.exe 29 PID 2372 wrote to memory of 2348 2372 ArenaWarSetup.exe 29 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30 PID 2372 wrote to memory of 2500 2372 ArenaWarSetup.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1216 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --mojo-platform-channel-handle=1384 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1612 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:2500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1624
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵PID:2480
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""2⤵PID:1936
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"3⤵PID:1520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"2⤵PID:1280
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2396
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"2⤵PID:1260
-
C:\Windows\system32\cmd.execmd /c chcp 650013⤵PID:1200
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:1052
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:752
-
-
-
C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"2⤵PID:2656
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f3⤵
- Adds Run key to start application
PID:2356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2560
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:1564
-
-
-
C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe"C:\Users\Admin\AppData\Local\Temp\ArenaWarSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1296,i,2064175977132387257,9819203374665859320,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231B
MD5dec2be4f1ec3592cea668aa279e7cc9b
SHA1327cf8ab0c895e10674e00ea7f437784bb11d718
SHA256753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
SHA51281728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66
-
Filesize
249B
MD5cf7e4a12f932a3fddddacc8b10e1f1b0
SHA1db6f9bc2be5e0905086b7b7b07109ef8d67b24ee
SHA2561b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b
SHA512fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
2.7MB
MD534338c8a774bc30c223f228b3ef394bb
SHA198ae6592b53d35261b1a122d5b60bea7a8d8fb96
SHA256d868ca7a24ce77b9ed0d78ce2e75e85f7c342888def0b8d65a9a965b81d3e1ab
SHA512b728b18adc32111c53210282dae660fea7bab66e6dee4ae62f8761e5e8cb1ff4db3420a04d861a60949221d8611b0fa0d02d4963ae1a3d338d0f7f4af20a90f7
-
Filesize
641KB
MD5b68521b5ef83bcfa58f1e00b19988cfc
SHA12a5d9afd619e2a57df212730a8b8566dc3fcf824
SHA2560f666f8eb35b704692d0c78557b5a0cc0858a4b1422b53d3cae11785e057a56a
SHA5122c2db152a9ef51e2f6177f09c98fa58f998aed5775a500f81191c40a31e1185ec833e7c5ecbe84f59665b03e06e38d5070f4145ab46c652109c49a264ddca960