Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Mauqes.exe
windows10-1703-x64
7$PLUGINSDI...er.dll
windows10-1703-x64
1$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...ll.dll
windows10-1703-x64
3$PLUGINSDIR/app-32.7z
windows10-1703-x64
3LICENSE.electron.txt
windows10-1703-x64
1LICENSES.c...m.html
windows10-1703-x64
1asdasdasd.exe
windows10-1703-x64
7chrome_100...nt.pak
windows10-1703-x64
3chrome_200...nt.pak
windows10-1703-x64
3d3dcompiler_47.dll
windows10-1703-x64
3ffmpeg.dll
windows10-1703-x64
1icudtl.dat
windows10-1703-x64
3libEGL.dll
windows10-1703-x64
1libGLESv2.dll
windows10-1703-x64
3locales/en-US.pak
windows10-1703-x64
3resources.pak
windows10-1703-x64
3resources/app.asar
windows10-1703-x64
3resources/elevate.exe
windows10-1703-x64
1snapshot_blob.bin
windows10-1703-x64
3v8_context...ot.bin
windows10-1703-x64
3vk_swiftshader.dll
windows10-1703-x64
3vk_swiftsh...d.json
windows10-1703-x64
3vulkan-1.dll
windows10-1703-x64
3$PLUGINSDI...ec.dll
windows10-1703-x64
3$PLUGINSDI...7z.dll
windows10-1703-x64
3$R0/Uninst...sd.exe
windows10-1703-x64
7$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...ll.dll
windows10-1703-x64
3$PLUGINSDI...ec.dll
windows10-1703-x64
3Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
16/04/2024, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
Mauqes.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10-20240319-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-32.7z
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
LICENSE.electron.txt
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
asdasdasd.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
chrome_100_percent.pak
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
chrome_200_percent.pak
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
d3dcompiler_47.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
icudtl.dat
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
locales/en-US.pak
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
resources.pak
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
resources/app.asar
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
resources/elevate.exe
Resource
win10-20240319-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
snapshot_blob.bin
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
v8_context_snapshot.bin
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
vk_swiftshader.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
vk_swiftshader_icd.json
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
$R0/Uninstall asdasdasd.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20240319-en
windows10-1703-x64
General
-
Target
LICENSES.chromium.html
-
Size
7.9MB
-
MD5
312446edf757f7e92aad311f625cef2a
-
SHA1
91102d30d5abcfa7b6ec732e3682fb9c77279ba3
-
SHA256
c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
-
SHA512
dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
-
SSDEEP
24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577704309539428" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1184 chrome.exe 1184 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1908 chrome.exe 1908 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe Token: SeShutdownPrivilege 1908 chrome.exe Token: SeCreatePagefilePrivilege 1908 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe 1908 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 3844 1908 chrome.exe 72 PID 1908 wrote to memory of 3844 1908 chrome.exe 72 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 1900 1908 chrome.exe 74 PID 1908 wrote to memory of 4304 1908 chrome.exe 75 PID 1908 wrote to memory of 4304 1908 chrome.exe 75 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76 PID 1908 wrote to memory of 3672 1908 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0x44,0xe0,0x7ffcdeac9758,0x7ffcdeac9768,0x7ffcdeac97782⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:22⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:82⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:82⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2804 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:12⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2812 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:82⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:82⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:82⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 --field-trial-handle=1860,i,3970165355177977452,2545704908965589605,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5a1f7b8462de28bf8c24e8ef4956809ae
SHA185a3fd7b5b11778cdaa3b9b63e23576dccbf2bb3
SHA256f145bed3f7531e9b1d3417d707c020481201ea38043a43fc2920190bb0a1c5ed
SHA51215bd43d8423397ebaec6dd4f52d034bce0305bf8e4853701ae60425ab860a2c9cdeb9e582ebbcbde26a5ede481a95efc76c1309b22d41e131ee13ba549133c7d
-
Filesize
6KB
MD5872a042c713352a8c7283d49bd57092b
SHA14342cf8413d4aa7a62b891a93473d833bcbe06b1
SHA256dbeda6e9905edd0fb50ba0a7d9c6a7949cddab5f9369deccd5ad2f4083bf9fba
SHA512be138fce8f23d88a4f1955610025a3582ccaf1a4bc9fd4b664191b9dec54509ebea0fda5eaf1ff7a2a2a110a5421895c5d409933c2b07a5513152d2d7d1163d6
-
Filesize
138KB
MD58d54ea236afb6d43d19439a4249112e8
SHA1efe47f52789b4e81ddacb3124831f6bfcb86983a
SHA2569faded86e2c9ba6f5965238b9786e7023f668ad91808f49b12f301ea33189303
SHA512a7c32afdbc5ed09182932e40b16c2b03daa4d5a8fe09e26753c2ceaba1c31e124d5f10f4ba18b36d788368c0db9f5c97e3070823b7d6ce65030bf4e7f74cfddf
-
Filesize
137KB
MD53d4e510c1659439edafbc43652236912
SHA17c6aa8d72aab451e091527071036ff00102dfb19
SHA256c76193d662b2960eae11c7ec0fd8ed61dde234f132033ccfee992667f0709ff6
SHA51244ebd17af814b42be75c0f47ed59b370b7b7419c2afd898a7ceb590b4b03bced06fdaedb253c0e8a3e6682db4a5238263ff40895263c44beaf0e18bc096b3c1a
-
Filesize
138KB
MD50c1c140682f5cb2ed6c84f8ec1bbd4c3
SHA167b155e20a5b061d3e3adbd5228d4b2d7aa5f42f
SHA256234d848a3ba817c88d87e92981ddc8a6358ab04d0fe64082c25729f5790ed5fc
SHA512f0c7dc6705f0eb8de21b28b60537494c76662c641298f9dec93f6760f2f990fa313049ec0bc8e6a999f2c3cfb13e970a5b3e50191bbf489555871e37b6194533
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd