Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 04:10
Behavioral task
behavioral1
Sample
Firefox Installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Firefox Installer.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20240226-en
General
-
Target
Firefox Installer.exe
-
Size
341KB
-
MD5
06b34ae4dcc1111e74013f7f4eaeb19c
-
SHA1
62930bc389764b0f0277dc5b13f725b55d49329c
-
SHA256
f1a7dba708843124f16d5f83a914f6169237086547215eae6afce42b7c25e9c3
-
SHA512
e7684ceaffe7920cfa6a4ecfea1b669bdd979ad57a7a770860e3a7f329b3bcd175e29ff66cbc02336360daee645b5a5cb5c8a0cdcffa3d47c7b4241f1764d37d
-
SSDEEP
6144:TaVWdyzOxeA1DfdwX3MmIOiH3nnnoS8+6z7R5xifG33RPC1is0JogP5DvXUTocDR:TMROxdDfOnMmXiH3nnnn8niEB9pvqHdn
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3040-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3040-73-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\nsg5641.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsg5640.tmp\ setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsg5642.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsg5643.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsg5642.tmp\ setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsg5640.tmp setup-stub.exe -
Executes dropped EXE 1 IoCs
pid Process 1652 setup-stub.exe -
Loads dropped DLL 7 IoCs
pid Process 1652 setup-stub.exe 1652 setup-stub.exe 1652 setup-stub.exe 1652 setup-stub.exe 1652 setup-stub.exe 1652 setup-stub.exe 1652 setup-stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3276 1652 WerFault.exe 83 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606519482296514" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1652 setup-stub.exe 1652 setup-stub.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1652 3040 Firefox Installer.exe 83 PID 3040 wrote to memory of 1652 3040 Firefox Installer.exe 83 PID 3040 wrote to memory of 1652 3040 Firefox Installer.exe 83 PID 4768 wrote to memory of 2200 4768 chrome.exe 104 PID 4768 wrote to memory of 2200 4768 chrome.exe 104 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4964 4768 chrome.exe 105 PID 4768 wrote to memory of 4204 4768 chrome.exe 106 PID 4768 wrote to memory of 4204 4768 chrome.exe 106 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107 PID 4768 wrote to memory of 1340 4768 chrome.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\7zS0EB7F347\setup-stub.exe.\setup-stub.exe2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 22563⤵
- Program crash
PID:3276
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1652 -ip 16521⤵PID:2052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6d04ab58,0x7ffa6d04ab68,0x7ffa6d04ab782⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:22⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:1340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4732 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4848 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4564 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4452 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4492 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3664 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4464 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=1732 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4224 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:82⤵PID:112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3224 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5332 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4448 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5284 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5536 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1640 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5332 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4684 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4928 --field-trial-handle=1948,i,4050234646976212529,18390105162672370335,131072 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD500f84f0032a9c43aa42760d457266a26
SHA1f8c96156f0a0faa97e3579e4a122cfa4e7f40c4d
SHA256909b402452c009738de9284a0a81833e295a61d9462cf8941c333b9ac9962db9
SHA5126da2b7a5e958a8fd7b77ea1dca870b394149952654601cde53fd2b695fb939c5bb2c2192042a4062c58afa81df343cf56091dbe418c5242bd6dbfb4caf7a6bc9
-
Filesize
2KB
MD546fbe745b2267459162ce87ff5bd8119
SHA1be3cdcf9acf8e969a6a3a56d1a4d27eb9fa8f91e
SHA2566f6402766908da0b2f5c279873de1c852cfae0b8da9e2a1135ac27fd4d2320af
SHA512b8605ab74e2c043b26cd082193c9bc9e8bc7588fe34d26c11660a4e246413d84766562568297eb77478f5cf7b6e75434eeb85610608561ce84fb7c840162b32c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5414384fa8e461837de0f8784fdb55ca7
SHA116e16976df9e9fa5f93bdb19716e4a4a5e99a224
SHA2560952fc1170911799b7780b0e5b2c04fcbd4ea59a48793fb94e900af5a02187d9
SHA5129b7927618335d06fb1256ec0738e43e6ae46a3cdba62d54636667aa393ebdbfd71d468d40550401c2d726a418ab4131d3f88a4e6df91b3ed97f6aee44f962a45
-
Filesize
692B
MD5f5a601e19539a0594320bfc9f10c7056
SHA1da1d274913f577a53800cd48a7e216a7d6a5eb7d
SHA256c9246815b71f7d13172643a0bccdcfde3b4d514eb4eeba1d03d1131c8be53346
SHA5121af2e1e2890defe95538f5923cac80fc03827ef30d31460fe4a2bfee55ea91fe01aed9a81bc8c177afa4d7ad8abfb2ed2eefed4cc2abc5f2cb7972ee8c252a69
-
Filesize
859B
MD56fd5a7f55699e9efa8adf1ce0416543a
SHA1c9ff5523eb8ab1b0a016188663d53ec8e1099802
SHA25655f6a1f36731000cb5765be8b004f1febca99d3c066d56104b15fa7d3ac34478
SHA512b866d193a021c2c5cca26d9cae9a8d947ea9f1bf34cb8b73df82ab8af17597ed84b0df1fbbcb488d8f18d9c0f5699de06eeac98259921cd71cd526f8620a36c1
-
Filesize
7KB
MD51b5b9d948e84765490773783ef7acce3
SHA15b254be90c4142f9d64765017a407b33c6653b3a
SHA25683be961f8e6c7580f712e767fe069937372ef1a15260097ee463463c999e1d24
SHA51281aab2911b88ec3a4ca1acd90c89994be0faea9fa2982b067bb7b03a364000016d6932591b06fc2525cf1c987a6a438331b85646f4cbe81b3f33142a8f9f348a
-
Filesize
7KB
MD572a04bdbc44934b70e55f0c65b0af899
SHA1effb4372eb539b8daeadf35482256b22ef245d0d
SHA256d7caada47a3b56994c162af77934d1772c73d0d61fb9c25982d444d3dc1762e5
SHA51274c1f3bb2c4ce10d139554eff5c6db01addaa9851b25bd87e53e1908e312171e9647f8101f3e7572d8d6c88b1b1ab6e0fa037b46767dc6955af9001a66d5330f
-
Filesize
6KB
MD58f47a0eb5265b5108e8428e47f5cef6d
SHA1d49f5f1b05fde1175856d82426f5299a4f1b4230
SHA256d1c529b2148aebd2865abae08e8e43d736fe1a35c06c78e3f8aeca781d553252
SHA51213a6f06aecd9a08d1cb4741cb3c0d38ecfd1ad57c812be75d8abf291cc611a1445715a73508922262500a93be4400d5159442c6a50c4e72045d655dd1c047e37
-
Filesize
16KB
MD5ddb4987f1112d394f100c08893f5ec74
SHA128ca9be4b37be25319e2becd435617a8c8e242f4
SHA25658cf4323f5afb00f7eb72c086aafe01e3dbcd56d26f544ee24bf817d3e48191d
SHA51244bb041b86343525e4a520f94e3fee565d693d2622451af5b65cf6498cc80287bd61f4772c58fc02c11c8875e6bf35d1b874850672f886327910863cc689c5fd
-
Filesize
259KB
MD5140d4c2bbcb4e43572a46a7a34a0a56c
SHA1e7b93ce2e6da7494b4331e8bc78623a35bcb2d73
SHA25676be341679684228d6df46a357d22d35a0774a6cb743b6ba80ac220a1554387a
SHA5123042af26df1d9df4787e236f851fd9ab0d44cc287464b3ab919f8ce5182b9dadf6395b269c54be21e1da9584aad3cf18d9c07a5a9b273dea2dd1008a0d6ec4d8
-
Filesize
91KB
MD5f0ecce7d60942336c8c1458678582baf
SHA1bcc38246697ad9f36e0416edeae2a8724af3f848
SHA256aee9df841c86560ea52d398ba5fe93ab6e6a7b166124ada7c28bd65ed01256c5
SHA512a62d37e77fa8709250084effab6a2e0ba4980677f6d323e87d85584aa9eb07e5b848e8341a4e6ac8413e9a9378a0a0a413a5141360ee5a54ecf8b85be121dacf
-
Filesize
88KB
MD577eca677e1a715d64834491fee5cfcdc
SHA10afa16ac2cb6f752281b62182c086ae4f390b364
SHA25619324ff681c297d6c4c51f56a733976fc7a1f41844365a6f7381c6b66b8fc193
SHA51265c13339828a62c09257908724fa0e4d29e4feb93ec52021d3dd27f1de257ace773de88849629873ea71f0269e8cde1bfa7773928830e0ca95ec88a92613ccdb
-
Filesize
550KB
MD5e5cb36cf06b545691e641e6b1b4d1b54
SHA1a9f8133fc86205b6a58092998255546b7cd3d612
SHA25683cb88f2fdfd9849c1ecddd41a8c3dc242c3a337d312ba2024011c71912ca8fb
SHA512554505711ca23089e1134307bc20c55ec9319f58c65b74444df69f35429d19d9b74ae92fd5539e90acd040476a0e94adf7a95926ba60a1a9998829bb1f69bca2
-
Filesize
53KB
MD52021acc65fa998daa98131e20c4605be
SHA12e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA256c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
SHA512cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
-
Filesize
17KB
MD597c607f5d0add72295f8d0f27b448037
SHA1dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c
SHA256dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5
SHA512ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268
-
Filesize
22KB
MD5b361682fa5e6a1906e754cfa08aa8d90
SHA1c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA256b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
SHA5122778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
-
Filesize
28KB
MD5d23b256e9c12fe37d984bae5017c5f8c
SHA1fd698b58a563816b2260bbc50d7f864b33523121
SHA256ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
SHA51213f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
-
Filesize
14KB
MD5610ad03dec634768cd91c7ed79672d67
SHA1dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA256c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
SHA51218c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
-
Filesize
103KB
MD5b53cd4ad8562a11f3f7c7890a09df27a
SHA1db66b94670d47c7ee436c2a5481110ed4f013a48
SHA256281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
SHA512bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81
-
Filesize
1KB
MD51cb97b5f8c5f2728b26742d1d0669899
SHA1bb5ab1b8c00810fcb18184a996573c5accdc72c3
SHA256dec82e9caa154300e1aa44f550c16b455a2025be4fb1c3155cb75fe04a6b6611
SHA512768ed2b070485f3bbcf457aefdc0ef8f1737ad8ac4a2703e2feaff424f9a2c69a2f5928a3be898932ef4976a44ea829a099d090bd9941a24d045d5c8ac8b7b43
-
Filesize
1KB
MD5d845e8f4c0edb3cab17e6a30090ac5b8
SHA1654f058570f0868f0acc5f0595147f3385a9c265
SHA2561adcfdd9768242c6c639b10e4f0bcda24f6a957a169c1dede265e40336ecbd4f
SHA512401d800c484b74401b90c3285d8b6cc0018baf4979d6ec7bb174f7810d3f60adfa6b4cebeafcee20d5a7c3597447f755af19c5fecf1863e2438fe427dbdf9fed
-
Filesize
815B
MD5efce3dce0165b3f6551db47e5c0ac8d6
SHA11e15f6bb688e3d645092c1aa5ee3136f8de65312
SHA256dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e
SHA512cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988