Overview
overview
7Static
static
3setup.exe
windows7-x64
7setup.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Salwyrr Launcher.exe
windows7-x64
7Salwyrr Launcher.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1owutility.dll
windows7-x64
1owutility.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1resources/...ct.jar
windows7-x64
1resources/...ct.jar
windows10-2004-x64
7resources/...er.jar
windows7-x64
1resources/...er.jar
windows10-2004-x64
7vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Salwyrr Launcher.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
Salwyrr Launcher.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
owutility.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
owutility.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/elevate.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/libraries/java/PackXZExtract.jar
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/libraries/java/PackXZExtract.jar
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/libraries/java/launcher.jar
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/libraries/java/launcher.jar
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral31
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
vulkan-1.dll
Resource
win7-20240611-en
windows7-x64
General
-
Target
Salwyrr Launcher.exe
-
Size
150.5MB
-
MD5
358fcbfda7fdc5e8966be81cd82e3fc9
-
SHA1
1ca3c9cd0e791c82f139c543449630653447c33a
-
SHA256
bcc98408be7d77e03ca6fd8f1e7e01d30f3b55e3bb236735d514037f6b2da53f
-
SHA512
bc26f6e9395386791a7438e2e2f25644029584e6c318775b20cf8f13d268397b6a0e2f6ad8b2ccf726dc8a1102c6b08cef9a00fbd83855b65b0626deba009956
-
SSDEEP
1572864:ZGdFYlhnXsryUGmVlsdBbd51I8udcDs/VgC5daNcBgBTIWfbgrLvNc3xhRsOmpe:nlhnXr7er5c+rp
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Salwyrr Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Salwyrr Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Salwyrr Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Salwyrr Launcher.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1196 Salwyrr Launcher.exe 1196 Salwyrr Launcher.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe Token: SeShutdownPrivilege 376 Salwyrr Launcher.exe Token: SeCreatePagefilePrivilege 376 Salwyrr Launcher.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 376 wrote to memory of 1068 376 Salwyrr Launcher.exe 80 PID 376 wrote to memory of 1068 376 Salwyrr Launcher.exe 80 PID 1068 wrote to memory of 3468 1068 cmd.exe 82 PID 1068 wrote to memory of 3468 1068 cmd.exe 82 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 4916 376 Salwyrr Launcher.exe 83 PID 376 wrote to memory of 768 376 Salwyrr Launcher.exe 84 PID 376 wrote to memory of 768 376 Salwyrr Launcher.exe 84 PID 376 wrote to memory of 3344 376 Salwyrr Launcher.exe 85 PID 376 wrote to memory of 3344 376 Salwyrr Launcher.exe 85 PID 376 wrote to memory of 3168 376 Salwyrr Launcher.exe 86 PID 376 wrote to memory of 3168 376 Salwyrr Launcher.exe 86 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87 PID 376 wrote to memory of 4524 376 Salwyrr Launcher.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"2⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1760,i,6800478839790120533,5702463730959541056,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --mojo-platform-channel-handle=1836 --field-trial-handle=1760,i,6800478839790120533,5702463730959541056,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2364 --field-trial-handle=1760,i,6800478839790120533,5702463730959541056,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:3344
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=cs "--cs-app=Salwyrr Launcher"2⤵PID:3168
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1760,i,6800478839790120533,5702463730959541056,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:4524
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1760,i,6800478839790120533,5702463730959541056,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1760,i,6800478839790120533,5702463730959541056,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
28KB
MD5e2d7e79441280fe96f5275a5ede48bee
SHA1d7930c6f4d51082330dadb3418a1fb1397dcd1c6
SHA25654aa596375d1ad8ac335d0ddf854e11608dce950d861be279cf4958c72e2b2ce
SHA512aab97cf717e9bb340924533db02583c0bf8f6181fb7ac5e1cafeeb61c47761844d3817626fecaa4ef4c37d738009c4a2660c50260e210cd481089403b08fc889
-
Filesize
57B
MD558127c59cb9e1da127904c341d15372b
SHA162445484661d8036ce9788baeaba31d204e9a5fc
SHA256be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA5128d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a