Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 01:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe
-
Size
897KB
-
MD5
0c9e276d4ef89feb58c3526ddd8f4bf5
-
SHA1
d7d0552f88883d5ef40fdb0814d5a560bd15c526
-
SHA256
4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50
-
SHA512
ee76d8c442e688a86577cf426abf2327b05ad600ec043980376ec4fd6eb56c61e1198ed4f57684698722ad13988f4b3553f41957cad9abb1f059cb81f1d745cc
-
SSDEEP
12288:BqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga1Tg:BqDEvCTbMWu7rQYlBQcBiT6rprG8ahg
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 2500 taskkill.exe 2724 taskkill.exe 2832 taskkill.exe 2860 taskkill.exe 2844 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2664 chrome.exe 2664 chrome.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2500 taskkill.exe Token: SeDebugPrivilege 2724 taskkill.exe Token: SeDebugPrivilege 2832 taskkill.exe Token: SeDebugPrivilege 2860 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe Token: SeShutdownPrivilege 2664 chrome.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2664 chrome.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2500 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 29 PID 2324 wrote to memory of 2500 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 29 PID 2324 wrote to memory of 2500 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 29 PID 2324 wrote to memory of 2500 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 29 PID 2324 wrote to memory of 2724 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 32 PID 2324 wrote to memory of 2724 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 32 PID 2324 wrote to memory of 2724 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 32 PID 2324 wrote to memory of 2724 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 32 PID 2324 wrote to memory of 2832 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 34 PID 2324 wrote to memory of 2832 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 34 PID 2324 wrote to memory of 2832 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 34 PID 2324 wrote to memory of 2832 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 34 PID 2324 wrote to memory of 2860 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 36 PID 2324 wrote to memory of 2860 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 36 PID 2324 wrote to memory of 2860 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 36 PID 2324 wrote to memory of 2860 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 36 PID 2324 wrote to memory of 2844 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 38 PID 2324 wrote to memory of 2844 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 38 PID 2324 wrote to memory of 2844 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 38 PID 2324 wrote to memory of 2844 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 38 PID 2324 wrote to memory of 2664 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 40 PID 2324 wrote to memory of 2664 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 40 PID 2324 wrote to memory of 2664 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 40 PID 2324 wrote to memory of 2664 2324 4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe 40 PID 2664 wrote to memory of 2616 2664 chrome.exe 41 PID 2664 wrote to memory of 2616 2664 chrome.exe 41 PID 2664 wrote to memory of 2616 2664 chrome.exe 41 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42 PID 2664 wrote to memory of 2400 2664 chrome.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe"C:\Users\Admin\AppData\Local\Temp\4d020512e5ffd9fcc7bdcadb66fe0f0fc5e322dfd2d33b6c00ddb67a834bdc50.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6da9758,0x7fef6da9768,0x7fef6da97783⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:23⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:83⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:83⤵PID:276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1468 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:13⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:13⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1728 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:23⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3196 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:13⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 --field-trial-handle=1364,i,7202866865116707021,10338120910464743670,131072 /prefetch:83⤵PID:1752
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD54ac3727affb86ba1325493de2b30f905
SHA11199feb7534758048acf6c49ebc696da9857c3ff
SHA256f073aa6e1353a85bd901c1c714e8a01024bcf73722418f33f8aaee0bf723db53
SHA51278eb8ca6d31ef3e1e7d39338e06f9ef900c64eb230b3b401ebb4fa91400d17cd39b08e1d02c6365e65d14fbdf31d6be19a9d037bfc6452af80dc59540fd13359
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdbfaa72-23dd-4ee9-82c8-6f1c02c071bf.tmp
Filesize6KB
MD5b13690dede503cb12bf116dd17a26478
SHA19c80dcc7992ac99c5f2a8512be7944a07f1dbcb1
SHA256c8e4748337ef1b36dd3fc0cef3d53dbc3c26515a7e09500d569ff0de21898777
SHA5121cad8d46fccf49aff4fc291acbaf87aec68d959f9da6aca2d68f0555fd4d4d55422e0429d4e5298493d59a169bf90de2bbb51ae8b3dc466783c20957789288e6