Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
-
Target
53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe
-
Size
964KB
-
MD5
4e6fa3d48f7806ecaaafc20ca8ed25be
-
SHA1
ea53c5ff0ae8b5238525e6c0f61e656a22bc1820
-
SHA256
53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84
-
SHA512
fb7d62afef42084790f2436d1c107549097facd1085cac7026e736ce6cee508a457de981c0d0d7782704c81a3c317ddda0e5372f5dfc2308fb70008bf36053dc
-
SSDEEP
12288:MP2RKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:MPvBpDRmi78gkPXlyo0G/jr
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 640 Logo1_.exe 2592 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\copilot_provider_msix\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\ResiliencyLinks\MEIPreload\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\ResiliencyLinks\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\images\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe File created C:\Windows\Logo1_.exe 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe 640 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2592 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe Token: 35 2592 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4856 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 94 PID 3352 wrote to memory of 4856 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 94 PID 3352 wrote to memory of 4856 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 94 PID 4856 wrote to memory of 1524 4856 net.exe 96 PID 4856 wrote to memory of 1524 4856 net.exe 96 PID 4856 wrote to memory of 1524 4856 net.exe 96 PID 3352 wrote to memory of 4828 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 97 PID 3352 wrote to memory of 4828 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 97 PID 3352 wrote to memory of 4828 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 97 PID 3352 wrote to memory of 640 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 99 PID 3352 wrote to memory of 640 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 99 PID 3352 wrote to memory of 640 3352 53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe 99 PID 640 wrote to memory of 884 640 Logo1_.exe 100 PID 640 wrote to memory of 884 640 Logo1_.exe 100 PID 640 wrote to memory of 884 640 Logo1_.exe 100 PID 884 wrote to memory of 1872 884 net.exe 103 PID 884 wrote to memory of 1872 884 net.exe 103 PID 884 wrote to memory of 1872 884 net.exe 103 PID 4828 wrote to memory of 2592 4828 cmd.exe 104 PID 4828 wrote to memory of 2592 4828 cmd.exe 104 PID 640 wrote to memory of 2016 640 Logo1_.exe 106 PID 640 wrote to memory of 2016 640 Logo1_.exe 106 PID 640 wrote to memory of 2016 640 Logo1_.exe 106 PID 2016 wrote to memory of 904 2016 net.exe 108 PID 2016 wrote to memory of 904 2016 net.exe 108 PID 2016 wrote to memory of 904 2016 net.exe 108 PID 640 wrote to memory of 3360 640 Logo1_.exe 56 PID 640 wrote to memory of 3360 640 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe"C:\Users\Admin\AppData\Local\Temp\53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1A.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe"C:\Users\Admin\AppData\Local\Temp\53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:1872
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:904
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4140,i,8757378233529949334,7852422992079505686,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:81⤵PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5616f8c1916ec81484c8aefe8899f7c35
SHA14e5fc08bd9b2994582dd4f7fc33f544a89bc5fd5
SHA256d00dd083b9e7d238419f3f6d4c9c67489b752d8a44911a7ab4d8e9758ca63919
SHA512f2fc79f30a6eb798d2b8916341014849cf2375d011b14577ef40f13906f44c1bf512203979b3ca8ac544e84e503d2cce93b0c4408f50b05a862996dd49d90fca
-
Filesize
577KB
MD578e854681e1d3a897c7e1a32d8154138
SHA18c86c373573f432e25b80870cb36dbddfee8fd22
SHA256b805779bc7ea0540d443d40fcb8bfeac750bac62d3d989e90e0c75e92b6cdbf5
SHA5120fbb1bea1de300ff06b3a7ddc2bbdcc1f000e2641ef79fa48e7158f10db961cb3d1731265fd3a11b6ef12ebbb34af344c32404b38b84227a881e1db734cd9bbd
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD5f9bda517f882e3c2636d44cfa30c8ef0
SHA106822afcd175307e76db635fa14c80b4708458ba
SHA256cb3149e29fc3c22b6ed7a427146780eb251e10b54153139535f6999b33037de8
SHA512e6c867020f86944f79cb768de9a01c60c36bbbf2937cf8cecb096ad578d06a2a37a3976665f2063da1e3e3be62ff26b520abe26d442e084e0b496d5ab08e1050
-
Filesize
721B
MD582907aa9f867ec87a34e4b626d127804
SHA1e24f9df8f330af87cbb54f0df0df3890b88091ca
SHA2563ef1264cf6d340457737800d48e4bf67b0b62369e3a13e85a9d1365144a1cdb1
SHA51275fe4dc86f0553dac8be341149218f908cf9a0b536ce1b56c4e16007284cb10905f78c9e49cd1c88ef7c5129f998970e79406bbc46dec7881e83e39091e0baa2
-
C:\Users\Admin\AppData\Local\Temp\53e09db4381338931ced58f706360dd7f8b004bbd5fe3db1861447aa79d98b84.exe.exe
Filesize930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
33KB
MD55f4b64deb280c001783cf744b06bef33
SHA1e3962fe8ed4214be0cf4605b5ec6114320949eed
SHA25653f7b777df32f27c60853a9b5d65a8e6f99cddd820daaead05f938239d6bdb35
SHA512ad10ff2e3837acc133e0945e58f1fd3748242506d47694ad4efed6ac22325c7383ced5bc57dec390b3fd09952f5ffaef6946982972d67a969f333573492ed3cd
-
Filesize
9B
MD5137c71ab33d39f41d1d0f506748620c6
SHA1615708c800cedc2541589174e6e677e1563367b5
SHA256f1a3a71540f6e454bf800af51e8e8085c233f7281852519bd8b0ae36071f13e0
SHA512cb8e0ffac4c5606dec5cc9ccdb6ac981ed120efc64a4f4750ac59149280da5fb379c2af737bde3d9e23ca21c3ee3fa9e6c252dee9ef22102886e2390c9d504fc