Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7vivitar/Setup.exe
windows10-1703-x64
7vivitar/runsetup.exe
windows10-1703-x64
1vivitar/st...g.html
windows10-1703-x64
1vivitar/st...t.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...a.html
windows10-1703-x64
1vivitar/st...P.html
windows10-1703-x64
1vivitar/st...g.html
windows10-1703-x64
1vivitar/st...t.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...a.html
windows10-1703-x64
1vivitar/st...P.html
windows10-1703-x64
1vivitar/st...g.html
windows10-1703-x64
1vivitar/st...t.html
windows10-1703-x64
1vivitar/st...g.html
windows10-1703-x64
1vivitar/st...t.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...P.html
windows10-1703-x64
1vivitar/st...g.html
windows10-1703-x64
1vivitar/st...t.html
windows10-1703-x64
1vivitar/st...a.html
windows10-1703-x64
1vivitar/st...P.html
windows10-1703-x64
1vivitar/st...g.html
windows10-1703-x64
1vivitar/st...t.html
windows10-1703-x64
1vivitar/st...h.html
windows10-1703-x64
1vivitar/st...a.html
windows10-1703-x64
1vivitar/st...P.html
windows10-1703-x64
1vivitar/st...e.html
windows10-1703-x64
1vivitar/st...l.html
windows10-1703-x64
1Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/04/2024, 01:05
Behavioral task
behavioral1
Sample
vivitar/Setup.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
vivitar/runsetup.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
vivitar/startup/data/de/loading.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
vivitar/startup/data/de/nointernet.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
vivitar/startup/data/de/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
vivitar/startup/data/de/tutorial_Vista.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
vivitar/startup/data/de/tutorial_XP.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
vivitar/startup/data/el/loading.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
vivitar/startup/data/el/nointernet.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
vivitar/startup/data/el/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
vivitar/startup/data/el/tutorial_Vista.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
vivitar/startup/data/el/tutorial_XP.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
vivitar/startup/data/en/loading.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
vivitar/startup/data/en/nointernet.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
vivitar/startup/data/es/loading.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
vivitar/startup/data/es/nointernet.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
vivitar/startup/data/es/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
vivitar/startup/data/fr/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
vivitar/startup/data/nl/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
vivitar/startup/data/pt/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
vivitar/startup/data/pt/tutorial_XP.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
vivitar/startup/data/ru/loading.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
vivitar/startup/data/ru/nointernet.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
vivitar/startup/data/ru/tutorial_Vista.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
vivitar/startup/data/ru/tutorial_XP.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
vivitar/startup/data/tr/loading.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral27
Sample
vivitar/startup/data/tr/nointernet.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
vivitar/startup/data/tr/tutorial_Macintosh.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral29
Sample
vivitar/startup/data/tr/tutorial_Vista.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
vivitar/startup/data/tr/tutorial_XP.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral31
Sample
vivitar/startup/flash_detector_de.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral32
Sample
vivitar/startup/flash_detector_el.html
Resource
win10-20240404-en
windows10-1703-x64
General
-
Target
vivitar/startup/data/de/tutorial_Vista.html
-
Size
1KB
-
MD5
79f0ea7b5700ef8fe6cd5f15509e4707
-
SHA1
99f3d4bec783d81b876b0b6713fc7919cc9433ca
-
SHA256
7939b6769273c924a5a92407d9209310900a961053e4809dfbbd179ad5849ce6
-
SHA512
9168bf0884a2140535f91f1fa297ce5754e4cc0b4dae301d685e59cf1e01e56e1db09847ad1e2e8d61361b43f98cc8a235467d54ef8083637f760439cd2d7d5d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589127688884288" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 1628 chrome.exe 1628 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 64 chrome.exe 64 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe Token: SeShutdownPrivilege 64 chrome.exe Token: SeCreatePagefilePrivilege 64 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe 64 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 2144 64 chrome.exe 72 PID 64 wrote to memory of 2144 64 chrome.exe 72 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 1244 64 chrome.exe 74 PID 64 wrote to memory of 4960 64 chrome.exe 75 PID 64 wrote to memory of 4960 64 chrome.exe 75 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76 PID 64 wrote to memory of 1536 64 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\vivitar\startup\data\de\tutorial_Vista.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff801869758,0x7ff801869768,0x7ff8018697782⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:22⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:82⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:12⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:82⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:82⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:82⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1792,i,12685696874232006193,7447909506999638833,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD501da9448e31d40c477f8a39f5d9fcba9
SHA16a734d2cc6a5eff120d67b1dc91822205d631a64
SHA2566c20c0ea2435560bb11841b957937be0f82b8dd7547af43d7d89f0e525cfb225
SHA5125df88666217e41815fc94ddc372193847a28bcdfed58903cc061d340f934ae3cf31f5f8f9c7077d1c1dc606c72005f8fd06e3920f3bbd91df4415e8332495602
-
Filesize
6KB
MD5e8943bd2a707bc4e2b051ec2abb1708d
SHA19c95fcc869b457f8621a0d22377c6a1ac3ede26e
SHA256982c2077d024c473eabbdd5fa6cbb091cb2db6dd4aa2d65563e91dd832f003ee
SHA512f1d9052305e6c431a6dbe1456e21e02c16c4a6c982c186d12c3f6ae4e9e0161e7ec4e41eb17dc5f120746ec048186eb6d4620556dffab2610664244351bce16f
-
Filesize
6KB
MD56d9d09e360dd41bc6200f3f4d730041a
SHA1b2ed9d9a1d04b38322267f549ddf8399e369d753
SHA25648203bff12f669ec667f27e10175f18a21caabcb8ca8ff17f897962f55e01e35
SHA51274a2ef3b8d8a00b52a65b070fbd1a99fa6e8208febdd020d290663388773e5ce8ce3ac97b2537c77e2c3183b0a945da72d0397536a06e12855884951a91a026d
-
Filesize
138KB
MD505658932d77383a614277e2eb4588a32
SHA118f2d70f72d2b86b21a3db63b0a9de14e9a7d0e6
SHA25651d363bf94b0a965ad44ba9b6a2212f73ce5aa9ba45938d42d7ff8142536629e
SHA512d8f68ef1f47dcfdb049af42e9c30096d6e3f864b6920b3186daad13609492fb03417802bafe27151684075edf6bc3a0dd02b94a982b95494fc2a8e9137a89568
-
Filesize
158KB
MD5dc7c99748d87ac373de7bfebdc23366b
SHA1883987e503efdd0944a71253c6b35112d8c3d6cc
SHA2561c5451fdea2a28f86b557a1fef99d2b725fbc4b29258b6231157aa080a767896
SHA512e74fa98418505dbfba36e52fed6dedaf74bb2ff4f1903baf8334176be22b19a31c596bb6f2100cfe6388d48deeb8ee0ae64e5b8556f34442e25b1040b23aaadb
-
Filesize
137KB
MD5a7678198fdf7bbdbc8d21a5499ab8458
SHA127d626e72eced8a4a833f1d1247f8c5c220b0363
SHA25670735fca39da344aa385ca515aa845814e740476cbeb6fe2cf60fecd1dea2727
SHA512212ccc562714f78a059ca020ae11a85654734d2cd5142d2fdd5db1af7ffdb5331d7465d95c8d72da0c96b1eff95aba2b10a9619c4a9ec91348eec4f7c2f903b4
-
Filesize
138KB
MD538fa6762407b6ddf6ef99dd958c58493
SHA1ae0d1823d49c70e5f438eee2c37da939ded503ef
SHA2560e9f204754dfefb12ab5183d66961cf3345dd1c1615cf126f468bc32d1d53ada
SHA5125f1473e11a5b4ec971693a2357eb45f8579c2d047bdf6afdb8e2416816b1a162b07bd42df09b83c818ede8ab9e2902632c425c08096214de1de8587a7e871835
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd