Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10WCLDll.dll
windows7-x64
1WCLDll.dll
windows10-2004-x64
1msvcp140.dll
windows7-x64
3msvcp140.dll
windows10-2004-x64
3ptMgr.dll
windows7-x64
1ptMgr.dll
windows10-2004-x64
3ptusredt.dll
windows7-x64
1ptusredt.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
3vcruntime140.dll
windows10-2004-x64
3wbxtrace.dll
windows7-x64
1wbxtrace.dll
windows10-2004-x64
3x64/Templa...te.htm
windows7-x64
1x64/Templa...te.htm
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...re.dll
windows7-x64
1x64/plugin...re.dll
windows10-2004-x64
1x64/plugin...po.dll
windows7-x64
1x64/plugin...po.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1Analysis
-
max time kernel
606s -
max time network
602s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 05:32
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
WCLDll.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
WCLDll.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
msvcp140.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
msvcp140.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ptMgr.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
ptMgr.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ptusredt.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
ptusredt.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
vcruntime140.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
vcruntime140.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
wbxtrace.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
wbxtrace.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
x64/Templates/TemplateCorreoCliente.htm
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
x64/Templates/TemplateCorreoCliente.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
x64/plugins/MahApps.Metro.IconPacks.BootstrapIcons.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral18
Sample
x64/plugins/MahApps.Metro.IconPacks.BootstrapIcons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
x64/plugins/MahApps.Metro.IconPacks.BoxIcons.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
x64/plugins/MahApps.Metro.IconPacks.BoxIcons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
x64/plugins/MahApps.Metro.IconPacks.Codicons.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral22
Sample
x64/plugins/MahApps.Metro.IconPacks.Codicons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/plugins/MahApps.Metro.IconPacks.Core.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
x64/plugins/MahApps.Metro.IconPacks.Core.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/plugins/MahApps.Metro.IconPacks.Entypo.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
x64/plugins/MahApps.Metro.IconPacks.Entypo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x64/plugins/MahApps.Metro.IconPacks.EvaIcons.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
x64/plugins/MahApps.Metro.IconPacks.EvaIcons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x64/plugins/MahApps.Metro.IconPacks.FeatherIcons.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
x64/plugins/MahApps.Metro.IconPacks.FeatherIcons.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
x64/Templates/TemplateCorreoCliente.htm
-
Size
2KB
-
MD5
ce4c1f3ba9e690c4119e8ed39aa8eb78
-
SHA1
dc2da00c92b51431c01c5e598de4665c9989e856
-
SHA256
e17621dc67919e53a0d1be6a03fa0d97f01c8932f8d8912d556327e620310432
-
SHA512
daf95e6329b060fe230096fc7a594cf0a13801e2dcf9869affa5530a2d03bf6c0dd2d9340be5c312b82d41dad48057f86811a23b23fba93b0dc9a478986ac4ef
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548686848787678" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4884 chrome.exe 4884 chrome.exe 5860 chrome.exe 5860 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4884 chrome.exe 4884 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe Token: SeShutdownPrivilege 4884 chrome.exe Token: SeCreatePagefilePrivilege 4884 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe 4884 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1328 4884 chrome.exe 97 PID 4884 wrote to memory of 1328 4884 chrome.exe 97 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 4588 4884 chrome.exe 99 PID 4884 wrote to memory of 3392 4884 chrome.exe 100 PID 4884 wrote to memory of 3392 4884 chrome.exe 100 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101 PID 4884 wrote to memory of 1692 4884 chrome.exe 101
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\x64\Templates\TemplateCorreoCliente.htm1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa355d9758,0x7ffa355d9768,0x7ffa355d97782⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:22⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:82⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:82⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:82⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:82⤵PID:5152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2372 --field-trial-handle=1892,i,1546560375518223417,10583830855466719216,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3848 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:5508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5399c0723b0fc3469226d1cd1b478b9d4
SHA1b49dd3ad441bccee71f2c8252c6a20fc53d6979f
SHA2564dec4f96b6609c01596ae3e1bc1dba70274b34f819dc00bc6aab46f95fa0ac2b
SHA512912f94ff887001f499db343edf493aa1f2f7629ffd41606e367df0a76658d429e555104fdc4935cfe855c540f52dc23c80db1ba22259a5f133e89c5a2c9a3a68
-
Filesize
5KB
MD5e3a937a31e43fef289a81b2927b1f60b
SHA17ab1635a7cdbd84cfcf80081ab74af611d609f32
SHA2561a57efe4a2f81c75d9387cfd21c4312c2914616d466208a6dbc42a5c02a3c885
SHA5120a1c69435783af25f82054260702e9d206d7e8d3c8e3534f8f77374bbf8e5371770c99849fabbed0ca5f2396f87a5777fdfacbb171dfebe050245c9793475735
-
Filesize
5KB
MD5f791c3982e09f3057822e6d880fed311
SHA11b6322f0d132832a30f2ff7c84cde09f738c2006
SHA256e103e1bf3be00b1bfe692f5e2d905687ca3ca47d94097bb374df9a5d03791131
SHA512d5aa18cc99048c1606d09f2767dd6190ebe871af245933323d60d89e09ae84cc2a0a87125f13b7973ad7e4b0fbe85b9c9d8d0a1f88c959d4606d87f7c6fd1d04
-
Filesize
128KB
MD5df96d82f9d2652dc641612659950cafb
SHA1ac64d3f6d6193b3f37cc8a6ef2d2af2973797016
SHA256c56ec86d014ad8e997ea773054834771e2dd8bee9d9184c1f6b04186853faa04
SHA51296ea572471edcfb7cec53ad36897ad16567c2de25bc18ce889fc795e04bf055f87333960ec48582f87fb3837aa642d8d9630fe555cfdabd90df30f155ddeb2ed
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd