Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8PySilon-ma...nux.sh
ubuntu-18.04-amd64
1PySilon-ma...nux.sh
debian-9-armhf
1PySilon-ma...nux.sh
debian-9-mips
PySilon-ma...nux.sh
debian-9-mipsel
PySilon-ma...on.bat
windows7-x64
1PySilon-ma...on.bat
windows10-2004-x64
1PySilon-ma...der.py
windows7-x64
3PySilon-ma...der.py
windows10-2004-x64
3PySilon-ma...ler.py
windows7-x64
3PySilon-ma...ler.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ies.py
windows7-x64
3PySilon-ma...ies.py
windows10-2004-x64
6PySilon-ma...64.dll
windows7-x64
1PySilon-ma...64.dll
windows10-2004-x64
1PySilon-ma...isc.py
windows7-x64
3PySilon-ma...isc.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ons.py
windows7-x64
3PySilon-ma...ons.py
windows10-2004-x64
3PySilon-ma...rol.py
windows7-x64
3PySilon-ma...rol.py
windows10-2004-x64
3PySilon-ma...put.py
windows7-x64
3PySilon-ma...put.py
windows10-2004-x64
3PySilon-ma...sod.py
windows7-x64
3PySilon-ma...sod.py
windows10-2004-x64
3PySilon-ma...per.py
windows7-x64
3PySilon-ma...per.py
windows10-2004-x64
3PySilon-ma...ing.py
windows7-x64
3PySilon-ma...ing.py
windows10-2004-x64
3Resubmissions
10/06/2024, 13:26
240610-qpxbcsxbra 810/06/2024, 13:22
240610-qmq2kaxfll 810/06/2024, 13:16
240610-qh9m4swhle 8Analysis
-
max time kernel
44s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 13:22
Behavioral task
behavioral1
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral3
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral4
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
PySilon-malware-main/PySilon.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
PySilon-malware-main/PySilon.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
PySilon-malware-main/builder.py
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
PySilon-malware-main/builder.py
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
PySilon-malware-main/compiler.py
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
PySilon-malware-main/compiler.py
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
PySilon-malware-main/resources/discord_token_grabber.py
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
PySilon-malware-main/resources/discord_token_grabber.py
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
PySilon-malware-main/resources/get_cookies.py
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
PySilon-malware-main/resources/get_cookies.py
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
PySilon-malware-main/resources/libopus-0.x64.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
PySilon-malware-main/resources/libopus-0.x64.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
PySilon-malware-main/resources/misc.py
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
PySilon-malware-main/resources/misc.py
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
PySilon-malware-main/resources/passwords_grabber.py
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
PySilon-malware-main/resources/passwords_grabber.py
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
PySilon-malware-main/resources/protections.py
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral22
Sample
PySilon-malware-main/resources/protections.py
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
PySilon-malware-main/resources/source_code/audio_control.py
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
PySilon-malware-main/resources/source_code/audio_control.py
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
PySilon-malware-main/resources/source_code/block_input.py
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
PySilon-malware-main/resources/source_code/block_input.py
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
PySilon-malware-main/resources/source_code/bsod.py
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
PySilon-malware-main/resources/source_code/bsod.py
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
PySilon-malware-main/resources/source_code/crypto_clipper.py
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral30
Sample
PySilon-malware-main/resources/source_code/crypto_clipper.py
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
PySilon-malware-main/resources/source_code/file_downloading.py
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
PySilon-malware-main/resources/source_code/file_downloading.py
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
PySilon-malware-main/resources/libopus-0.x64.dll
-
Size
431KB
-
MD5
0e078e75ab375a38f99245b3fefa384a
-
SHA1
b4c2fda3d4d72c3e3294beb8aa164887637ca22a
-
SHA256
c84da836e8d92421ac305842cfe5a724898ed09d340d46b129e210bdc9448131
-
SHA512
fa838dab0a8a07ee7c370dd617073a5f795838c3518a6f79ee17d5ebc48b78cebd680e9c8cbe54f912ceb0ae6112147fb40182bcfdcc194b73aa6bab21427bfd
-
SSDEEP
6144:QzvQP4JEH+xiPuym+Sl1AhOtw6qIUZtvJd3dbK2lbO2miHWQAD03N3hg9/To88jC:Q6Ho+8p0IU3BW2s2miwmOLozjJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2360 2060 chrome.exe 29 PID 2060 wrote to memory of 2360 2060 chrome.exe 29 PID 2060 wrote to memory of 2360 2060 chrome.exe 29 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2592 2060 chrome.exe 31 PID 2060 wrote to memory of 2456 2060 chrome.exe 32 PID 2060 wrote to memory of 2456 2060 chrome.exe 32 PID 2060 wrote to memory of 2456 2060 chrome.exe 32 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33 PID 2060 wrote to memory of 2324 2060 chrome.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\libopus-0.x64.dll,#11⤵PID:1964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef79d9758,0x7fef79d9768,0x7fef79d97782⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:22⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:82⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1392 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:22⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1408 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:82⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3324 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3060 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2468 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=540 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2860 --field-trial-handle=1372,i,10439086666257454660,11425271070930686637,131072 /prefetch:12⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52596dfa31f868ed943d607c59dc8fe08
SHA163e3c672abfaddd264fa9ede2ade98f897b8111f
SHA25646292ea9c7aca7cf8206b591045830bcaa045ad284ad98816c9c7295a7381440
SHA512f7a194b994af3f201d7c18c981a6cdf547b9827d9110823ca5d8036224b2490fa3cf6b1744ed11118429627d0c7423e5c5b97fb5d50dfaffadac81bf140b6660
-
Filesize
5KB
MD514891e89c996a38d595dfcf1cba9c74d
SHA1bf79eb513909e225d0782d68e12c544a5638cfef
SHA25655810129c3b993c57ee04e8919c765b980a6638694717c75f36a1c0ddb5c0f19
SHA512422681b27a09d38180ac5170ae02d95ec92a1bf6cda0e186c8c22aef094dd91b1094bd32d3a12db27ae76950bd8f3a74544e87e68cd6241074e8cb9133547eb2
-
Filesize
5KB
MD5bd75b2acbf3493d6ae337d0d924691ce
SHA1180d2ff20fe6ccf00215e6deae162a763135a083
SHA25604bad054cbb649d67f30d5e7cec8aa627dd939dd039bcfe5524bf41e3a1d1920
SHA512eebded4a4a3ba550cae11598ebfacef66f6a78f99a3f6343ca796de52c9d0e66b946ad50130b7ff14c10866cf61f1787c879b223fe179b292edb99f9f917a070
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58