Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/08/2024, 04:47
240806-fewxqstfrb 1006/08/2024, 04:46
240806-fedq6azenp 1006/08/2024, 04:44
240806-fc8thszeln 1005/08/2024, 13:30
240805-qr3ads1elc 10Analysis
-
max time kernel
300s -
max time network
297s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 13:30
Behavioral task
behavioral1
Sample
Avira Advertising/payment and key.exe
Resource
win7-20240705-en
General
-
Target
Avira Advertising/payment and key.exe
-
Size
4.2MB
-
MD5
ad433332d168ed1555d260e6b149e2fe
-
SHA1
beb4d3f2d7a8d2b4b194e7c123477010ea1a6baa
-
SHA256
7232ec3f17f009b1d24f7383d32a4b499288b000d5738758da0035252953e409
-
SHA512
bc4bd97db41debe9615d33a31b852f44c89b6ac43104241427f7ed742e771cc2ce590c583859e5368f2fd1e4c1b4ae57827a90ba1c095c76f0f2bc04857d8d92
-
SSDEEP
24576:h5yHx5/mc9iNTGYARvoqY6nNdcDMdvnLD4WlYrRkcXV7G4OVnw0cLOV:hIxcS8AY6nILfr
Malware Config
Extracted
lumma
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
Extracted
lumma
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2928 乒䍈䍍䥍䅉噅 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2784 set thread context of 2928 2784 payment and key.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 乒䍈䍍䥍䅉噅 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 乒䍈䍍䥍䅉噅 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 乒䍈䍍䥍䅉噅 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 乒䍈䍍䥍䅉噅 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe Token: SeShutdownPrivilege 3064 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 2784 wrote to memory of 2928 2784 payment and key.exe 30 PID 3064 wrote to memory of 2428 3064 chrome.exe 33 PID 3064 wrote to memory of 2428 3064 chrome.exe 33 PID 3064 wrote to memory of 2428 3064 chrome.exe 33 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1980 3064 chrome.exe 35 PID 3064 wrote to memory of 1940 3064 chrome.exe 36 PID 3064 wrote to memory of 1940 3064 chrome.exe 36 PID 3064 wrote to memory of 1940 3064 chrome.exe 36 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37 PID 3064 wrote to memory of 2940 3064 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Avira Advertising\payment and key.exe"C:\Users\Admin\AppData\Local\Temp\Avira Advertising\payment and key.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\乒䍈䍍䥍䅉噅"C:\Users\Admin\AppData\Local\Temp\乒䍈䍍䥍䅉噅"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67b9758,0x7fef67b9768,0x7fef67b97782⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1072 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:22⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:82⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:82⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:12⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:12⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1532 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:22⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1488 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:12⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=1328,i,9569804403327429784,11794615552555394523,131072 /prefetch:82⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2208
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1384
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x54c1⤵PID:1748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
633B
MD5f6a75f6328b7c5a33d6ba205945c0b4c
SHA17ae4e872a12cde7ea156e6398dee6a193596f570
SHA256f500b46cf2a9ea44c344f6a9aeefff85321949fc7453681e347185c344cc94fa
SHA512431a48fb49dbdd4eb5b6f5c9fbf918c7644bf6ef8943615b4f8026a8bca92c0e4d98ced05d9850ae9e582e0841ffa156302216d258e5e5248e72c0091b289ae8
-
Filesize
5KB
MD58552f5ea2db1c9e8e83a12237a73452a
SHA1e00be40815bf4c18e8650387c44beb9e2ace5d96
SHA2569209af708ca551277c3c320621c0e37fda44c380abcc22bb84a87619bf6c4040
SHA512f5459e698d0b7fc758d9ef69504ce9e6139129943fdba27d9372c8f25677ca51a378b959bc1c369ed8f71ea14a4341266b27a12b4abbb26aabd82629c9121832
-
Filesize
5KB
MD5c54279ce32d536d6b6cd9f7c041ac5ec
SHA1d352d6bdce05e471f88118b865c1399db0653712
SHA256f16ef8a63b9a9671c62fb1ac358927ea5020725b87473a232055687453c7e1e4
SHA5124e475dfe5791841c0effd49ac2dcbee0d0fee3a893a7e6b0b93bda13842e9512769aa28137be1d02cd9cf700edbd771a1b312a97f9e4a8715ab7a88a19a1893c
-
Filesize
5KB
MD5dd8e700cb62860fc3bc48ab19228dcb1
SHA1e05298324e82f4fec598946aa43a010f6de18454
SHA2560995ce9e493ec27850b1d52de5bfdd2b6e2a1adb91d9152caa4b5869ba6ddafd
SHA512e94db6ce1071d6e463c261b963de42d9920370c71509659f4c5973ae3b00547ab9837814297bd9dcd3fc85abafc416e65d65c4f5d2757304a995535ed7132d81
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
38KB
MD53992f464696b0eeff236aef93b1fdbd5
SHA18dddabaea6b342efc4f5b244420a0af055ae691e
SHA2560d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14
SHA51227a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6