Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
29/06/2024, 19:15
240629-xyjj7aterh 815/05/2024, 20:40
240515-zf52ksah5s 706/05/2024, 19:45
240506-ygg6gabc53 801/05/2024, 19:15
240501-xyhmwseb8s 827/04/2024, 10:03
240427-l3j6qsgh5t 8Analysis
-
max time kernel
113s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06/05/2024, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
EcosiaInstaller.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/MainModule.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
General
-
Target
EcosiaInstaller.exe
-
Size
1.0MB
-
MD5
ead03cdd9d3398c50ffd82d1f1021d53
-
SHA1
24b37f404d510f4eb7807dd89de20e936fc18190
-
SHA256
4bf7c84949d8e672e7244e1d36d93575eabeb825bf60b209885e317bbbd431e2
-
SHA512
ff381bd5ce7aef733c9ce9fcac0bcf3c9da106b09223c2904714bf4f7df334280ebf4792c279bea32cdafd896d5d95f28cbd6fc18a7d56c4fe77b63438fd6c70
-
SSDEEP
24576:WgZNRxRm9PQBwV418TeWyavVb5AudHRhItGsePtjDZeMizZBx7j:WgHRW9P0wCWy2auFRhIP6pkd7j
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation ecosiabrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation ecosiabrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation ecosiabrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation ecosiabrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation ecosiabrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation ecosiabrowser.exe -
Executes dropped EXE 34 IoCs
pid Process 4368 TempBr0.exe 2216 setup.exe 4056 setup.exe 1552 setup.exe 1932 setup.exe 4984 ecosiabrowser.exe 5080 ecosiabrowser.exe 2000 ecosiabrowser.exe 4828 ecosiabrowser.exe 1600 ecosiabrowser.exe 512 ecosiabrowser.exe 2132 ecosiabrowser.exe 2492 ecosiabrowser.exe 4632 ecosiabrowser.exe 1896 ecosiabrowser.exe 4864 ecosiabrowser.exe 3436 ecosiabrowser.exe 2208 ecosiabrowser.exe 4380 ecosiabrowser.exe 4112 ecosiabrowser.exe 2532 ecosiabrowser.exe 1768 ecosiabrowser.exe 4292 ecosiabrowser.exe 3976 ecosiabrowser.exe 3852 ecosiabrowser.exe 1968 ecosiabrowser.exe 1860 ecosiabrowser.exe 5332 ecosiabrowser.exe 5992 ecosiabrowser.exe 3960 ecosiabrowser.exe 4860 ecosiabrowser.exe 5376 ecosiabrowser.exe 5712 ecosiabrowser.exe 2200 ecosiabrowser.exe -
Loads dropped DLL 64 IoCs
pid Process 4676 EcosiaInstaller.exe 4676 EcosiaInstaller.exe 4984 ecosiabrowser.exe 5080 ecosiabrowser.exe 2000 ecosiabrowser.exe 4984 ecosiabrowser.exe 1600 ecosiabrowser.exe 4828 ecosiabrowser.exe 1600 ecosiabrowser.exe 4828 ecosiabrowser.exe 512 ecosiabrowser.exe 512 ecosiabrowser.exe 4828 ecosiabrowser.exe 4828 ecosiabrowser.exe 4828 ecosiabrowser.exe 4828 ecosiabrowser.exe 4828 ecosiabrowser.exe 4828 ecosiabrowser.exe 2132 ecosiabrowser.exe 2132 ecosiabrowser.exe 2492 ecosiabrowser.exe 2492 ecosiabrowser.exe 4632 ecosiabrowser.exe 4632 ecosiabrowser.exe 1896 ecosiabrowser.exe 4864 ecosiabrowser.exe 1896 ecosiabrowser.exe 4864 ecosiabrowser.exe 3436 ecosiabrowser.exe 3436 ecosiabrowser.exe 2208 ecosiabrowser.exe 4380 ecosiabrowser.exe 2208 ecosiabrowser.exe 4380 ecosiabrowser.exe 4112 ecosiabrowser.exe 4112 ecosiabrowser.exe 2532 ecosiabrowser.exe 1768 ecosiabrowser.exe 2532 ecosiabrowser.exe 1768 ecosiabrowser.exe 4292 ecosiabrowser.exe 3976 ecosiabrowser.exe 3976 ecosiabrowser.exe 4292 ecosiabrowser.exe 3852 ecosiabrowser.exe 1968 ecosiabrowser.exe 3852 ecosiabrowser.exe 1968 ecosiabrowser.exe 1860 ecosiabrowser.exe 1860 ecosiabrowser.exe 5332 ecosiabrowser.exe 5332 ecosiabrowser.exe 5992 ecosiabrowser.exe 5992 ecosiabrowser.exe 3960 ecosiabrowser.exe 4860 ecosiabrowser.exe 3960 ecosiabrowser.exe 4860 ecosiabrowser.exe 5376 ecosiabrowser.exe 5376 ecosiabrowser.exe 5712 ecosiabrowser.exe 5712 ecosiabrowser.exe 2200 ecosiabrowser.exe 2200 ecosiabrowser.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF}\LocalServer32 setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\123.0.6312.21\\notification_helper.exe\"" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\123.0.6312.21\\notification_helper.exe" setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ecosiabrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ecosiabrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ecosiabrowser.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry ecosiabrowser.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133594984362130546" ecosiabrowser.exe -
Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.xht\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.shtml setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.svg setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\ecosiabrowser.exe\" --single-argument %1" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\AppUserModelId = "Ecosia Browser.6QKC2T3TVOOK7WWRLZOUGOQ3OE" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\Application\ApplicationName = "Ecosia Browser" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\Application\ApplicationCompany = "The Ecosia Browser Authors" setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.svg\OpenWithProgids setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.xht\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\shell\open\command setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\Application setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.htm setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.shtml\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\shell setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\ecosiabrowser.exe,0" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\Application\ApplicationDescription = "Access the Internet" setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.pdf\OpenWithProgids setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\123.0.6312.21\\notification_helper.exe\"" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\123.0.6312.21\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\ = "Ecosia Browser HTML Document" setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\DefaultIcon setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.webp setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.shtml\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.svg\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.xhtml setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.xhtml\OpenWithProgids setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.htm\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.html\OpenWithProgids setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.pdf\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF}\LocalServer32 setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\EcosiaBrowser\\Application\\ecosiabrowser.exe,0" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\Application\AppUserModelId = "Ecosia Browser.6QKC2T3TVOOK7WWRLZOUGOQ3OE" setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE\shell\open setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.webp\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\CLSID\{CE9C26D8-7C04-4946-96FD-C95153F34CAF} setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.htm\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.html setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.pdf setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.webp\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.html\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.xht setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.xhtml\OpenWithProgids\EcosiaHTML.6QKC2T3TVOOK7WWRLZOUGOQ3OE setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: 33 4368 TempBr0.exe Token: SeIncBasePriorityPrivilege 4368 TempBr0.exe Token: SeShutdownPrivilege 4984 ecosiabrowser.exe Token: SeCreatePagefilePrivilege 4984 ecosiabrowser.exe Token: SeShutdownPrivilege 4984 ecosiabrowser.exe Token: SeCreatePagefilePrivilege 4984 ecosiabrowser.exe Token: SeShutdownPrivilege 4984 ecosiabrowser.exe Token: SeCreatePagefilePrivilege 4984 ecosiabrowser.exe Token: SeShutdownPrivilege 4984 ecosiabrowser.exe Token: SeCreatePagefilePrivilege 4984 ecosiabrowser.exe Token: SeShutdownPrivilege 4984 ecosiabrowser.exe Token: SeCreatePagefilePrivilege 4984 ecosiabrowser.exe Token: SeShutdownPrivilege 4984 ecosiabrowser.exe Token: SeCreatePagefilePrivilege 4984 ecosiabrowser.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe 4984 ecosiabrowser.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 4368 4676 EcosiaInstaller.exe 73 PID 4676 wrote to memory of 4368 4676 EcosiaInstaller.exe 73 PID 4368 wrote to memory of 2216 4368 TempBr0.exe 74 PID 4368 wrote to memory of 2216 4368 TempBr0.exe 74 PID 2216 wrote to memory of 4056 2216 setup.exe 75 PID 2216 wrote to memory of 4056 2216 setup.exe 75 PID 2216 wrote to memory of 1552 2216 setup.exe 76 PID 2216 wrote to memory of 1552 2216 setup.exe 76 PID 1552 wrote to memory of 1932 1552 setup.exe 77 PID 1552 wrote to memory of 1932 1552 setup.exe 77 PID 2216 wrote to memory of 4984 2216 setup.exe 79 PID 2216 wrote to memory of 4984 2216 setup.exe 79 PID 4984 wrote to memory of 5080 4984 ecosiabrowser.exe 80 PID 4984 wrote to memory of 5080 4984 ecosiabrowser.exe 80 PID 5080 wrote to memory of 2000 5080 ecosiabrowser.exe 81 PID 5080 wrote to memory of 2000 5080 ecosiabrowser.exe 81 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 4828 4984 ecosiabrowser.exe 82 PID 4984 wrote to memory of 1600 4984 ecosiabrowser.exe 83 PID 4984 wrote to memory of 1600 4984 ecosiabrowser.exe 83 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84 PID 4984 wrote to memory of 512 4984 ecosiabrowser.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\EcosiaInstaller.exe"C:\Users\Admin\AppData\Local\Temp\EcosiaInstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\TempBr\TempBr0.exe"C:\Users\Admin\AppData\Local\Temp\TempBr\TempBr0.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\CHROME.PACKED.7Z"3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data\Crashpad" --url=https://crashreports.ecosia-browser.net/desktop-browser-win --annotation=plat=Win64 --annotation=prod=Ecosia --annotation=sentry[release]=123.0.6312.21 --annotation=ver=123.0.6312.21 --initial-client-data=0x22c,0x230,0x234,0x20c,0x238,0x7ff6e4e8eaf0,0x7ff6e4e8eafc,0x7ff6e4e8eb084⤵
- Executes dropped EXE
PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=04⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\TempBr\CR_F889D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data\Crashpad" --url=https://crashreports.ecosia-browser.net/desktop-browser-win --annotation=plat=Win64 --annotation=prod=Ecosia --annotation=sentry[release]=123.0.6312.21 --annotation=ver=123.0.6312.21 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6e4e8eaf0,0x7ff6e4e8eafc,0x7ff6e4e8eb085⤵
- Executes dropped EXE
PID:1932
-
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --from-installer4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exeC:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data\Crashpad" --url=https://crashreports.ecosia-browser.net/desktop-browser-win --annotation=plat=Win64 --annotation=prod=Ecosia --annotation=sentry[release]=123.0.6312.21 --annotation=ver=123.0.6312.21 --initial-client-data=0xe0,0xe4,0xe8,0xbc,0xec,0x7fffd359bc40,0x7fffd359bc4c,0x7fffd359bc585⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exeC:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data\Crashpad" --url=https://crashreports.ecosia-browser.net/desktop-browser-win --annotation=plat=Win64 --annotation=prod=Ecosia --annotation=sentry[release]=123.0.6312.21 --annotation=ver=123.0.6312.21 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff63fac6340,0x7ff63fac634c,0x7ff63fac63586⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000
-
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4828
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --start-stack-profiler --field-trial-handle=1748,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1984,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:512
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2780,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2132
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=renderer --no-appcompat-clear --start-stack-profiler --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2492
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4100,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:25⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4632
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4516,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4864
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4340,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3436
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4760,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5032,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4380
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4112
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5056,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4292
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5288,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3976
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4808,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3852
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5600,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5604,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5916,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5332
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5920,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5992
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6056,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3960
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6340,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5940,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:25⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5376
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=renderer --instant-process --no-appcompat-clear --start-stack-profiler --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6092,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5712
-
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe"C:\Users\Admin\AppData\Local\EcosiaBrowser\Application\ecosiabrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5960,i,14906845354150396953,16457623774288264340,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵PID:964
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:4940
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:4404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520B
MD5d7bdecbddac6262e516e22a4d6f24f0b
SHA11a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA5121e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
-
Filesize
2KB
MD5fea64121572215ae20ef10b163ca46a7
SHA1d2d691b1be04ba9e898b4115a5a35b771df47d1e
SHA25600526b7e4ee66ca7514960a808b1ef4a6df53a6b05fa3b05b10e1909b24a26c0
SHA51269a24001cc15a2af3c3f58b33ab9e47f3be25c8a37e3ae1fe050b42b614757057a6fcfa348dc60151c156d88e387e670a367258898a84b4c8013ee3d8e819f02
-
Filesize
2.4MB
MD5fb5581a14f52e14086ee997273198788
SHA1ab92a654b218a630d0306279490121cc26abdbce
SHA256be6b12e03b36e586a1abb5fdd7f69928e4e1a1c85fce9f2ccdd0358232131c2d
SHA5126d6534a74b6d875756e2f1919f346b0e8c93449920b03aac96b2844b3f1d363488a529f214b707c9730553fddd5002b85f077cb1d5d949f7fecdfb60ac459bc9
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\EcosiaBrowser\User Data\Default\f96f64eb-2c00-40f9-bed6-8f849aca1882.tmp
Filesize154KB
MD5d36d18f82847cdf716f8d181db1afbbc
SHA1e820b54eb4a66ed95e7c9bd385de13de682e3f21
SHA2565d7adf329a38ce56fc02fbbe56456e37875c79c57e109812bd64229dd6de9192
SHA512d1f471340f9dfa84aa084e2980dfbcaf6483e40235cb923e1abadd5f655423cdc443799f7e5a37302eea88c8cb284bdeca33a80931899141031fdd3e50e4911f
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
2.6MB
MD5ffb2b92410a8d4808aa425d72acfaa0d
SHA1a3dda22a3dd64ae4a70c976bad73babad4cd78c9
SHA2568ae46d3c371e7835c5998d1e1d8a5665f45fa567dfe5e19461c01dd68d9bb26e
SHA512946e1b9d8dccdd655b69aabae2597620a30ecee3aa5df40190ab39574a5f1b39e7b687d920867f04e5e051d3c6c0c551a092fc09cef24e190fc8c12ea0953b97
-
Filesize
1.2MB
MD5ae0d60cfb1c9328269688e1baa88a943
SHA1f7de751e5d9e5049f85d0ad88ab69d18be1b7d5e
SHA2564bcabd79410e1f09555fce0851548066e8e720f54790c3d761d06925b2766641
SHA51219222280c38602750b02998d790dfe648d2be88334a95bd6d553d189d702b5102166827a5d5ab25a55c19fb788362fc3b3011b054951b0a62a7fe60a0c7e9873
-
Filesize
4.7MB
MD52191e768cc2e19009dad20dc999135a3
SHA1f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA2567353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA5125adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
-
Filesize
20.9MB
MD5150f0e3df0133148774ad54a42856603
SHA1709d42b5a7f2251291c78225946022591d1aa37f
SHA256ef457141e5ed3f7da23843abe149edfc490e70b6c11e0d9f5a4c2c56213e9e10
SHA512457dbae0d312897a3c555cbdd0d14e27ab1b30e864a713636664a7fdaabf04dbab4d340d09cb354bb68777a2f43e6c45edd1a085c1babd14fc552ebacd13b548
-
Filesize
1.4MB
MD5cb72bef6ce55aa7c9e3a09bd105dca33
SHA1d48336e1c8215ccf71a758f2ff7e5913342ea229
SHA25647ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893
SHA512c89eebcf43196f8660eee19ca41cc60c2a00d93f4b3bf118fe7a0deccb3f831cac0db04b2f0c5590fa8d388eb1877a3706ba0d58c7a4e38507c6e64cfd6a50a0
-
Filesize
470KB
MD53256b6aa8cf471075fa54a3f55226e4e
SHA1c048b56d0b9955ca3d7a247755bdde3ccdc72aba
SHA25677554d8f11ed4a59543d014de3253fbcf28e6b5cef8a00e1d0ff0cc5f168ce96
SHA5128f8c3a42982c90e614141dbf348e64f5acd3dc81072f81fcf946655f3522e4d60f0e2fbe74b17e2933182f15619bb53207085a6628513e33c265c67b09fe8b57
-
Filesize
7.3MB
MD5901a2a0be2869a84460058e15bc59844
SHA1c42eb917dede03bdb6f9f807e2180d15caddf06d
SHA25657bab60884711ea370f989ad7588698d3e2c23348297c3f309e64b97d532d673
SHA512802fcd9711478015e9bb2747f1716c83aec29598933d604fcdcf769ac432525cfd648923ce763ceaf6ee04256fede439bfbecc565eb7ffb5f81450f642f703d3
-
Filesize
4.9MB
MD563d04aae53e03e41a7d82f8431cc14f9
SHA11ee414e09abd9323b0250602342ff917607c8b7d
SHA256bbd5f144433b75fe0580b299b20ff743a0d21d93897375a75d8ad8a59b22608e
SHA512bac53a3b87f63604a98490fa4e2d921da5baa759574e76362115f49d67d31cd59bacb7cb8035a7cbbbda3267b6e195e6e2904f3b99b9a50d3fbd9ef928bca90b
-
Filesize
3.6MB
MD5c5f78d7f3df8b816ef881d342f6e9520
SHA1251a4bc26a697e4641483ce7a3ac694874d7be52
SHA256b0c4e04590f521358d7e3cf5201ffc551b6cbd7182a6e8229e94f47105c71822
SHA512c9af575cde74c1520ebd49df15116d4165e9c5314cc4c402463388552ee35768ddc31d8a3f38ab2488357e7fc112666e02c1c6ac6c9f4b6eeba787afcafaa2cd
-
Filesize
12KB
MD5564bb0373067e1785cba7e4c24aab4bf
SHA17c9416a01d821b10b2eef97b80899d24014d6fc1
SHA2567a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA51222c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472