Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10/07/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
лысому.txt
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
лысому.txt
Resource
win10v2004-20240709-en
General
-
Target
лысому.txt
-
Size
68B
-
MD5
73d740966f50dbacc22f6c9cb5b0c7af
-
SHA1
ade86ed3952482ab238d52a962129054ea04cb03
-
SHA256
060f3f02a4b6acb763c8811cd8edf1216ee63e64a3e6fd233fc7a914a93a0424
-
SHA512
97e3d6a27970c0aac4e7023f2aedfe332d12c72dd4c04c1cda40a82e60a8c0e14827bddcfad0fe9d001fe7ceae5eec8e1b755ee1c21aa03d71368171715729b2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133651071318756672" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4412 firefox.exe Token: SeDebugPrivilege 4412 firefox.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 4412 firefox.exe 4412 firefox.exe 4412 firefox.exe 4412 firefox.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 4412 firefox.exe 4412 firefox.exe 4412 firefox.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4412 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 2100 wrote to memory of 4412 2100 firefox.exe 75 PID 4412 wrote to memory of 4264 4412 firefox.exe 76 PID 4412 wrote to memory of 4264 4412 firefox.exe 76 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4588 4412 firefox.exe 77 PID 4412 wrote to memory of 4620 4412 firefox.exe 78 PID 4412 wrote to memory of 4620 4412 firefox.exe 78 PID 4412 wrote to memory of 4620 4412 firefox.exe 78 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\лысому.txt1⤵PID:2312
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.0.1195670197\761517852" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1724 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {059b97d5-3857-4bc3-9d91-23740daa4c3e} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 1812 265110d7d58 gpu3⤵PID:4264
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.1.641371574\1088992178" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bf71277-7d18-471f-ab05-18cc63fc88bd} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 2164 26511003558 socket3⤵
- Checks processor information in registry
PID:4588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.2.380267947\749251058" -childID 1 -isForBrowser -prefsHandle 2800 -prefMapHandle 2656 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9ada5c1-c57e-424e-8781-67d7f11c2976} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 2648 265152b4858 tab3⤵PID:4620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.3.2080665517\192559724" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3488 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {491a956e-9a17-44dd-9f9b-f4a0e5b3f38c} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 3496 26516115e58 tab3⤵PID:4172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.4.197901772\851567986" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4144 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b37bd95-1293-4de9-8ce6-896e6dad9d62} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 3640 2651662e258 tab3⤵PID:2556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.5.1389727548\234588448" -childID 4 -isForBrowser -prefsHandle 4844 -prefMapHandle 4856 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {230a2898-a207-4583-9f71-69781f6f4d95} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 4872 2651662fa58 tab3⤵PID:2800
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.6.1279213573\664888240" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 5024 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14bc9e6b-2025-46a2-bc86-e3b38b74aab9} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 4896 2657835b258 tab3⤵PID:5028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.7.1307608834\2081187622" -childID 6 -isForBrowser -prefsHandle 5208 -prefMapHandle 5212 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {942f564e-718a-41bf-bc62-6b4246ba379c} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 5200 26518487958 tab3⤵PID:3444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4412.8.1528924150\635369718" -childID 7 -isForBrowser -prefsHandle 5576 -prefMapHandle 5568 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80544367-78f6-4a01-b06a-52a5c8b29025} 4412 "\\.\pipe\gecko-crash-server-pipe.4412" 5608 2651901aa58 tab3⤵PID:1612
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4492 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa70599758,0x7ffa70599768,0x7ffa705997782⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:22⤵PID:168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:82⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:82⤵PID:164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:12⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4480 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:82⤵PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:82⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:82⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5180 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:12⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:82⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5340 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:12⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3940 --field-trial-handle=1864,i,14583657082549535426,9128068130145736794,131072 /prefetch:22⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5200cd59ecd27d6747d525cf933aae56c
SHA18f955527e5a43b96861b9d5d450de693e92e8b40
SHA256da0f26a52f95585a84691188652b1529705fd7996913d07035e28313ae9d715c
SHA512b7f7022c9de36743b7fe0d855d52def6b152860cc442f50ffca7f7142749c88661710456c26783219e08fc65711dee66775d792cdd929ee6fe6a048e1630c8e2
-
Filesize
3KB
MD511fc07fe51c7124e5f93c9a3b8fd61a3
SHA1d81a2db422e5c3543a3658119dfccb992bc0124e
SHA2560390a803b33952a229ce9ad9bf9e203ae28072ac0c34ba01bb9dac310b5e8ab7
SHA512aba6d7d0eeebcd769eac7cd8a9fa790c534b3e7e649f14278f048a8a22e1bd9acc056c589a2e5e8bf5003085ac002db89c7b0414cc3de9fc37fea7bb9c238504
-
Filesize
3KB
MD58021b911f6cade746bf8a48fa59778b8
SHA14ec72b47623dbf13e3073043ac4271d79e377ceb
SHA25677bcab52fd6a39925416f27df1d0af26382edc254ffb93b04f59f1433e7903c0
SHA512753684e632ee24f764b1d163b9f1cb974aedc9b6d1d3fc15d3f7ca776d392cdc6fb49ca56d0a815a32e3e0dd4fd103f32120da46247dd5b4617c46d92f3062d5
-
Filesize
2KB
MD5fad6d62ab57b561311de6993ad55bbcb
SHA13e403ab05a92d1bb7bc6bd8c5d7846fe1ecdfc01
SHA25632ef6c615973b542b21b4dce91204dba15eee9e8225c7d36860ef7f6bbd41239
SHA5123bc9a8a4404dca9e997060e25c1a0da07216603a12e0d2d2fae362b509bd3701de64d3765a923f20a2220c7aca30f589077c882b3a803cf2f1b5be0af1bb6590
-
Filesize
1018B
MD5f071f8c80baea36eeb409cac5b7d8334
SHA13933c94c7668456a7011a04df5dbe96f3d68a1a9
SHA25633e14632e4267d2346812482a164eb13350a95f7ae47cbaec5b9b30291c5aa7e
SHA5122e0b88811d4b23c27e13a0595ac93462aed651cfc3fef924a7e69734782a91bdfc42a9c9cb3b04ef973730c28bca24870bacf46ad9339c1499c4cc84f6bb2399
-
Filesize
2KB
MD5b0d0fcd89d74692808d607be3718e70b
SHA1ff35bfb5932a515432ef6bd055994e42bb5c8d32
SHA25692c272090a29998f75ea162db2dfbb9a399891d536512902aab8c184cce555a2
SHA512ce20a42f760256bd54ce574a51bdfc754cbdd298602d38881aab7ccc3dd0816a73c05d23c15091ffcb14d77c9063f49a40cd2c2859729897f85c5301e778a388
-
Filesize
706B
MD5fbb64fb349f77e73247886c60f82cb64
SHA1c085cf565282c32491518579b6b4d2a4e632186b
SHA25630ad9d027f6e7fb1ea97a845a4ffe107f23efe1c710d0aef044adc92f582c5aa
SHA5122c1fa75823d02ece2c55b13147aba92c9d036e7d1cd3a77383c249c2a064f9d3ff72201364f27dfe2fdad5fd3a8953871419519652324759c64fd1786e5d675b
-
Filesize
371B
MD5dd11a45d123d39778a258061cb82f6eb
SHA1342da87dd38c29479b9ef2901f2a3bc7834f23d0
SHA256fae413f96ba5a51738ea2b67e95b59570eca984f536aad622ce23927f3903201
SHA512a4276239996d04be092ca24cb5a958e6268d32b27c702fd14d581aebf776336ea7cadd5e8e591d5cf5c9aa56007dacfb0329b893d8b9f27bb20117c62765d27b
-
Filesize
706B
MD5f65ca9343746d5b745554db117bf2b2a
SHA1659e8bd908664b34196e7f1bb6c180223174e575
SHA25646388de2bfcc25ea8eb31b69768dce3b5445c9ebf8359f0e13ab07f7df5c52a7
SHA512c8dca15748755661350f7e027232813b5e56310c292ff65834a57db03bb8f74fd2bdaedb861641d31218bc5584ff1598f507ec50e932cf7a698dc4651a0bd526
-
Filesize
706B
MD585f6c784ceb59627850170136187e2d7
SHA1fbc33c54574006db9349658ac0a1af18eb9100ef
SHA2569fb6bf71ed993a26314db8b9599979ceccbc328e10dad386c0b4d29a62bbbad3
SHA512daa0b1eaa10ab09c8d272897670b18448638f4d2e5adb29bfd16d0625988d761c0425a911dc1ffcf3068f4881877b32033b37b7ef90c901e1d44e9dbc96095f5
-
Filesize
706B
MD5dd45133ee0f6684f5dcf2e42abecb0a4
SHA11ae1baf39009e875e91f994f5c16cc82ba38dda4
SHA2566522987028e61c95550fe48f11be620566d03e67bd4353e468794d5bdd3b8f53
SHA512faf046534156573fce864684b97b0bd3f84417f227b90fe44906842506fa7854d4cf4a26f6d06104238ce90080770a4cd26962e9c12d01776fb81509a175b3c0
-
Filesize
706B
MD53dd0ce61bdaf55dac1befed1de63d7ea
SHA185d45a74f4cb7f32d311129e0211366a252f854c
SHA2563bb25b3136e016117ce1443af4954651a8fab51f27ebe1b40662dab7cb4af7a9
SHA5125f056ccf57ff1ae691e79ac8ce57dad89305200846ade58a0e1ff7a2ec85a413158a9b959fab13a3b1282c0053585a1759002fb70a9045b996f3ae2658b0e9cf
-
Filesize
706B
MD5b20a39d9ae26ee50379280e351d7c8f0
SHA1ab264a91903bbc575b5517129956a8d5aa1d4729
SHA25604167e8b308e4daf495d5ccee15406191e6c0e83a95f0f3d4b187d5cb497fdb3
SHA512379065fd420cae99c21bde7ab81c98296564db139fa44cc4ec0acb8b1611a1adc8b0bd1afc694947943dcacbeb43bafc3fbc2ec12a2ce1e9a7cf7c85caf3549c
-
Filesize
706B
MD56c24a40f4fe0763eef70942a3cb3aa10
SHA170b2233a44240c7f0da51ced4f687ee32c990458
SHA2564721cf5fc024dc25197817ef939c4d56fb95ec81ee14091c50fe08b93dbaea5c
SHA5123a331004cf72b2712130b86d84ee47e5ea57e0dc30ab491ab5837477d19306e04c59705c36e4abc11a8434b10fca5d5a1225d5d61974aa6a61b6bb301196891f
-
Filesize
706B
MD51be065aacdfd7312b240b3651de33cc3
SHA1adb224190ee7c18d533c9bb437e1d54aaa7e42d6
SHA2569050b781fc437910ca55e7fe13fd6a7d16f7af660cb85f7e509bdedf11e22ea5
SHA512f9244e68439a0f0b5ccaf16bdd85ffdc0749a25a6f075bf2007f6b090ba23eb05745751fb598d0cc1ef405e1812120ae7f17c2ed0d3b51acae79c945d93551b2
-
Filesize
706B
MD5d9f4a60fdbe1da81f2cc164ec2adebea
SHA1abb6c622c709ae32baa7e1724a563cd55fe635cf
SHA256cdd147e066727ede520188aa2c945b7ce19a6edffb93acd035b64aadc993a90a
SHA51234b19c206d23a7bf118f45624b1fbc2e7302248be66c83227dbdc7940bcb9f60bda6549eb7b0a8ba3ecae685cb8e2bcf631a726126a088816b77eec9152b28b1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aab33269-0728-4f9f-9906-0b4d78827974.tmp
Filesize2KB
MD5d39f7d988ad3af56cefb3067aa8a48ce
SHA13480e18092c04cd7a397bf6692423d58f613891d
SHA25611c1f6e89a88a8888f3f33ccdb1f73ef72bface1b46fd377a981ad746d6d2415
SHA51277b64ed43cdd3f383db1c74c43100054fb0d923078f60b6cae5ed6938d6cfae6e5f6379e8b0d3916971da7c92ae590f7a2dabf58f7d656a3425475856b636e38
-
Filesize
5KB
MD55200aab001ebd7396bc441206d5b5042
SHA1ceaa9d36940d9fc88a5390e31960e18a1a20c39d
SHA2564fbeec16b64bf67409b716dd6e18309ad52a4ce1d4aadec505405d4a4fbc6989
SHA5129dcb148e45d9c7c3b8e2484cd9742c3f51c68d27fa406f1632f2c0da6f64a7c24704f515fd0a6949baabf44307e0a526694f1b2b25d899b74ddb25859b2fc2c7
-
Filesize
6KB
MD5df7cad9df8e1d9501293d462028cf7c2
SHA19f11b80b94483cd2792d7c9257ac2274a759aade
SHA2569df18e2b5c8fa0a718e416214e8050300190dc8f5a3684c2c2f30c0431d1679d
SHA512f5b88040db06b222ae988540c5bc3a3b8de10a3e74268e6559ee0b9209bc8648073cf53df10c61128a87fdaa0f5b2a17134dd5d7e409c464ebaa99e58e585e68
-
Filesize
6KB
MD59c297af9f61822f2c3e90338c66affdd
SHA1abca65355ffde392f05f5ecef8aa5fa2df8533ec
SHA256d1af562f45b520b9d7a1ae69c1826c3ad18ed9a55154538bacf718fe9bca0c23
SHA5124bd176c5c824423b34eff193c3ab50e3454e229a9b4213bb6639c9523c853ded5e0c32216fbe56372396fcf2db000b7e582edd41ecd4d3c4d62b5d170843edea
-
Filesize
6KB
MD5c5a6d34c1025109e86d8e0387a707ca8
SHA1fc54bccc12b1c98b03867c9fa6dd5c42f39cacc8
SHA256c5ce3e734ba588c6b22cd5022d88ce6206a19b290465713782da62fed012bd77
SHA5122dd1f743db6bd0e78846f8fc63a34fad39fc074a61653be8b35912e56d412d46338f9d07396a0e3858c435e34c5eeeb2f629ad1d2efe36b3bbfca36855ca5b4f
-
Filesize
6KB
MD5a9fe3d967f8654226683df50e4ef2ae2
SHA15790191f932da64b104bcbd5b9743a9d35bd91fc
SHA256cb5ac998952ecc6ecc8bb73f6b72440d539e7065d11877120e64a372fcc879e7
SHA512c23c8fbdcbbd9fe0e75bd68a39975a68acd59f1c3bddc90deb6d0809ea33de0de177f36eb2b1dba7d2db71cc7092a020123cef3bdd7bc1212e38bbb20661d1d4
-
Filesize
12KB
MD5c371a766ede1884253f722a0f9d38eec
SHA183ed8846438bf7935ad7c65c85edcc80ba66cd4b
SHA256a38889ebb80fe9b1804d70c91b7f175108bfd781c46d0fd1c1910376a6555881
SHA5124cfd5f58e529dfc184de0382c9033c6989c875c6d365f03e7ce7d952cd65a2073088fc5953ea65dd9d3b2373eda49278f422bae1068a8a114eb521adfef5ff55
-
Filesize
286KB
MD55bbc4a83dd54ae3e65231f4e803bdc60
SHA1522fdd196c9dbf23376c1f57574ef32c30234ade
SHA256698d9818e53ff172f361cb08c2d3a71e7437c95a3f9b7fd9675a3942ccb63f3d
SHA512419dd9a5cc8c7658bfd19a27fb7abb9f3ba161335ebd00b9472568d0f039da487aca75f5ec6287e4343efb785ab1c5bb3671b6cdeed11916c5ee0474af4db18c
-
Filesize
97KB
MD52ed117b0220e67096214de0cc7a58ca7
SHA1f1902e6284dc702529b3451b4b83958b90b459e4
SHA256f83b9a23e29b550d5db01aebc6e0f3693d5a2d05131d499098ee1c4e7bdce62b
SHA512b929f7608cf0c8340f97416b2e53b26ca8a1dc961f39f7947a5ccdf7f3643e52e5b2a34b555e2637d297cba73c10ffa72a293faf9c0ab4feda9847677fc15096
-
Filesize
92KB
MD5b3b541f93288d2e04641c85b378b60eb
SHA128173ffcb2d9e4430aca5996ecde52f5a770826f
SHA256cae79810bf966e293ca55eeb7c09b7e4b2923d002692ee7d8630766e4e1a4adf
SHA512ce97334672e197cc6c431b2db3f44143fa2c38f85d4d8cabf563121945396c374ce72c7a1444b0c8dbedee19a0621c63258b63bccedf5d7db2c551c44c623885
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5e5704821b1dafe0a358e158dc35a5b3b
SHA1d91edb32c8c0727781df8a431a427907c852333d
SHA2561bfbda55063cb20e6d514debfdc07eb652d85e908a50b9601887317069efe1ce
SHA5121b088a9001abcac3a6adb0e92f99fd9c713ae0409701d77b1ebdbba1b5da48f322da0ffd46babee3befc8a3f9deaa2132000c5517e8c15eeccafb15ee7b94304
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\866cc317-94cb-4f55-adf7-c04ca287a07d
Filesize746B
MD5fedb8829d064d80945cfd4e5cb47d3e5
SHA198eb7f4f033f840bc4c57a396e1dca1f5d2a49a1
SHA2562ef74f4fd5dc0654bdcbe911354d008a07ff667c754e9393638e429718d1292e
SHA5124eaa3d16a52f6573493f65da808353c9a362ec529860bf13d3a4cc07dcc40c98ea140752549e7d4d763d634a0281a94c0b3c4bec96df5fc6574f1729f0386a6a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\96d44a17-72bb-4540-bfa5-6acad8a67356
Filesize9KB
MD5c4bf65a5b4b1eb260ad800f7cd28ad9e
SHA1955b3b6fcc0e9092f2cfc6aa37163d0a89da180e
SHA256c723034afda734afe38e04dfa8635962e27ab6dd6142d23c852d9b585cfb8268
SHA5129666f4a697a45c30b783828ecbe51934edb914b8b7a986f383ccb9981a446e1137f5f7678dabd936e2179a367f3e36edff2e03e8d69686c6dbe558a44d2931f1
-
Filesize
6KB
MD5d628b2125653283ace27450f687ac349
SHA1da7a3dd747394349fb60e6b634d58dd9ead115d3
SHA25639d1010e48c2ec42798b2f10e1750a6d474091acdb11ebc414163ff861450d33
SHA512bfe24fa42296a5ed5a2c37dd77732de0a0ccd8a3aecab51d1d57a8c65cb19eeb883cea69c8a6c07beedd3247407fa1ab9b14858e6cbdfe802643004345bfc186
-
Filesize
6KB
MD51a5733e93753d3c37c282b57c375e5e3
SHA103ecd2f5a50ae5e1c74cfbf85b7c171e863d7629
SHA25684abf4104ea296b00e25d2feb1173cf5c3844e25938c2a0f372a3ff2702b34b1
SHA512c13481a03a60fbf7e8f7a57dd2610201aae01aa5a210078b4e2d85492f9248d819f5ee89ae39a01782ab6481b85d42d27ae31f2bf8a05e0d9b873615a6f2f48c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionCheckpoints.json
Filesize259B
MD5c8dc58eff0c029d381a67f5dca34a913
SHA13576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA2564c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
SHA512b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5982f5e617b83793c3b414355b9ba184a
SHA1a479db5378db887ded8421d7b45ee46a95f4f843
SHA25656886e7fb2f7efd7f6d0d02646ece04eb50c2eaf4ca690e9a186293a84da9417
SHA5129fd3547571104c028b1ccdf96d7e8a589a64cecec5872cfa30baf2860b6b3d1fcec023fd23756a67a082380b5d531f8fc23919c1ed27523cfd58a4464c39bc96
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD54604cecc63e64f7a284bd19722d300e9
SHA15305ec18a8c884ac01e78a5acbfd62fb3861f31f
SHA256449d1348fd162f1c5e49bcd6f71cc13a8907efda8f84c9c07eccb3564446414f
SHA512ee5c60dc0f674ea702167f10d2ca628939e1d31ebbe5be253ee22fe46703bea9262111db7a7bc6534c02be12ff28c50482a240be6332e87346b809bb04b191e4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore.jsonlz4
Filesize4KB
MD5013af8702473741b42f7ea1077cad65c
SHA12a56903008ca9074043c891f250fea4aab16e963
SHA256b3413cb7f2d8c4e5533f079d52ed251537bd6b3d051a5a693b540afd1c3cad47
SHA5122f3bd585ccc7e3e77dfe38bb23fd88b27599eba96f2a9705d185ba3ea7f228a19df53489af7402be93e16157ccf89d1b6f99f9c85cec2f5cd029b161bfae0a65
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD50d0013d9708d9fef539adc917f5b87f6
SHA15e071e6b4d8abf007c8bb78ee948caf5bb0439e1
SHA256f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b
SHA512851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388