Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
188s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
Netflix Checker v0.2.2.rar
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Netflix Checker v0.2.2.rar
Resource
win10v2004-20241007-en
General
-
Target
Netflix Checker v0.2.2.rar
-
Size
127KB
-
MD5
43db5cdaa1fb1f396dcb95d3e0c94631
-
SHA1
3e537a84cfdd59080d5adad6a671e3ada1f2ce24
-
SHA256
8d17ffff67960e33b37d30c33fc83656a914111c09cfdf6c6faafe528e53ca28
-
SHA512
f3956cfcf7cafa806989329928044481d3276539914033e07ed74e08434405f485bb38031d6cf21d3359dc2fafca9cc56802a89c86123a0e671af8c8ad40d030
-
SSDEEP
3072:O+TgyWyRfLEhDN8NKW53UgsRnv5jj1vooy4EjcYh/UuxCjk+7z:tWytwx+Nz3UgsRnhjhvoloYy3n7z
Malware Config
Extracted
redline
Diamotrix
176.111.174.140:1912
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x00070000000194e6-35.dat family_redline behavioral1/memory/2456-37-0x00000000002C0000-0x0000000000312000-memory.dmp family_redline -
Redline family
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 2752 Netflix Checker v0.2.2.exe 2912 sysappec.exe 2800 Netflix Checker.exe 2456 5957.tmp.x.exe 1956 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe -
Loads dropped DLL 28 IoCs
pid Process 2540 7zFM.exe 2752 Netflix Checker v0.2.2.exe 2752 Netflix Checker v0.2.2.exe 1156 Explorer.EXE 1956 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1496 6D16.tmp.zx.exe 1156 Explorer.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\D7FBC25C82B03973544187\\D7FBC25C82B03973544187.exe" sysappec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 36 discord.com 39 discord.com 40 discord.com 41 discord.com 28 discord.com 29 discord.com 30 discord.com -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x000500000001a495-40.dat pyinstaller -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5957.tmp.x.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2540 7zFM.exe 2912 sysappec.exe 1156 Explorer.EXE 2456 5957.tmp.x.exe 1408 chrome.exe 1408 chrome.exe 1156 Explorer.EXE 1156 Explorer.EXE 1156 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2540 7zFM.exe 1956 6D16.tmp.zx.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2540 7zFM.exe Token: 35 2540 7zFM.exe Token: SeSecurityPrivilege 2540 7zFM.exe Token: SeIncreaseQuotaPrivilege 2912 sysappec.exe Token: SeSecurityPrivilege 2912 sysappec.exe Token: SeTakeOwnershipPrivilege 2912 sysappec.exe Token: SeLoadDriverPrivilege 2912 sysappec.exe Token: SeSystemProfilePrivilege 2912 sysappec.exe Token: SeSystemtimePrivilege 2912 sysappec.exe Token: SeProfSingleProcessPrivilege 2912 sysappec.exe Token: SeIncBasePriorityPrivilege 2912 sysappec.exe Token: SeCreatePagefilePrivilege 2912 sysappec.exe Token: SeBackupPrivilege 2912 sysappec.exe Token: SeRestorePrivilege 2912 sysappec.exe Token: SeShutdownPrivilege 2912 sysappec.exe Token: SeDebugPrivilege 2912 sysappec.exe Token: SeSystemEnvironmentPrivilege 2912 sysappec.exe Token: SeRemoteShutdownPrivilege 2912 sysappec.exe Token: SeUndockPrivilege 2912 sysappec.exe Token: SeManageVolumePrivilege 2912 sysappec.exe Token: 33 2912 sysappec.exe Token: 34 2912 sysappec.exe Token: 35 2912 sysappec.exe Token: SeDebugPrivilege 2912 sysappec.exe Token: SeDebugPrivilege 2456 5957.tmp.x.exe Token: SeShutdownPrivilege 1156 Explorer.EXE Token: SeShutdownPrivilege 1156 Explorer.EXE Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1156 Explorer.EXE Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeDebugPrivilege 1156 Explorer.EXE Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1156 Explorer.EXE Token: SeDebugPrivilege 1156 Explorer.EXE Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeDebugPrivilege 1156 Explorer.EXE Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe Token: SeShutdownPrivilege 1408 chrome.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 2540 7zFM.exe 2540 7zFM.exe 2540 7zFM.exe 2800 Netflix Checker.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe 1408 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1156 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2752 2540 7zFM.exe 31 PID 2540 wrote to memory of 2752 2540 7zFM.exe 31 PID 2540 wrote to memory of 2752 2540 7zFM.exe 31 PID 2752 wrote to memory of 2912 2752 Netflix Checker v0.2.2.exe 32 PID 2752 wrote to memory of 2912 2752 Netflix Checker v0.2.2.exe 32 PID 2752 wrote to memory of 2912 2752 Netflix Checker v0.2.2.exe 32 PID 2752 wrote to memory of 2800 2752 Netflix Checker v0.2.2.exe 33 PID 2752 wrote to memory of 2800 2752 Netflix Checker v0.2.2.exe 33 PID 2752 wrote to memory of 2800 2752 Netflix Checker v0.2.2.exe 33 PID 2912 wrote to memory of 1156 2912 sysappec.exe 21 PID 1156 wrote to memory of 2456 1156 Explorer.EXE 35 PID 1156 wrote to memory of 2456 1156 Explorer.EXE 35 PID 1156 wrote to memory of 2456 1156 Explorer.EXE 35 PID 1156 wrote to memory of 2456 1156 Explorer.EXE 35 PID 1156 wrote to memory of 1956 1156 Explorer.EXE 36 PID 1156 wrote to memory of 1956 1156 Explorer.EXE 36 PID 1156 wrote to memory of 1956 1156 Explorer.EXE 36 PID 1956 wrote to memory of 1496 1956 6D16.tmp.zx.exe 37 PID 1956 wrote to memory of 1496 1956 6D16.tmp.zx.exe 37 PID 1956 wrote to memory of 1496 1956 6D16.tmp.zx.exe 37 PID 1156 wrote to memory of 1408 1156 Explorer.EXE 40 PID 1156 wrote to memory of 1408 1156 Explorer.EXE 40 PID 1156 wrote to memory of 1408 1156 Explorer.EXE 40 PID 1408 wrote to memory of 2080 1408 chrome.exe 41 PID 1408 wrote to memory of 2080 1408 chrome.exe 41 PID 1408 wrote to memory of 2080 1408 chrome.exe 41 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43 PID 1408 wrote to memory of 1228 1408 chrome.exe 43
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Netflix Checker v0.2.2.rar"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7zOCE9A9867\Netflix Checker v0.2.2.exe"C:\Users\Admin\AppData\Local\Temp\7zOCE9A9867\Netflix Checker v0.2.2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Roaming\sysappec.exe"C:\Users\Admin\AppData\Roaming\sysappec.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\7zOCE9A9867\Netflix Checker.exe"Netflix Checker.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5957.tmp.x.exe"C:\Users\Admin\AppData\Local\Temp\5957.tmp.x.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\6D16.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\6D16.tmp.zx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6D16.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\6D16.tmp.zx.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-http2 --use-spdy=off --disable-quic2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fe9758,0x7fef6fe9768,0x7fef6fe97783⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:23⤵PID:1228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=1432 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --disable-quic --disable-http2 --mojo-platform-channel-handle=1636 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1600 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:13⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:13⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1124 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:23⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1356 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:13⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=3676 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3692 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:13⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=2560 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=2556 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=2336 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --mojo-platform-channel-handle=3224 --field-trial-handle=1408,i,14694637962295187300,10438664850833503157,131072 /prefetch:83⤵PID:2196
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2852
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
354KB
MD50a168f4f5fefce96eb3636b7d772f02a
SHA1812a5314ed5af1193eac6c38f047366d8f037c6e
SHA256911247b09b8ec25c6bb14868e7c7ab038da6a627216f168c17db5a2ae24f276a
SHA512135ca4172ee0027cafc9fdac41150bc108e4431cbf6b6c99d7f7eb2160fce79b751148289fe17a03689607031077d557826b00a07eb3dccd7c21f7f4007209b2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1014B
MD50e5f260b261d17443451500d7f67d689
SHA1a26605b8fc55b53d137e84b68a960c7e3e4693b0
SHA256d5f6465afd27034ab14144231e0253c2144de8ad825eaeeb7793ddc0a339e20b
SHA51238a8cee313890f80567046ae8b3aaf306dd3520a832c5ad47348a7375bbad002909bf38160b3f4a6a9460c7554c9ddde1a81dd5a83d6172998398c5149d0f2ed
-
Filesize
361B
MD536e3aa2a3275d7eeef9c763a1a923afb
SHA113c1cf1360b219aa00da667246b4ab518f0c9841
SHA256c9eccb5aae1107c1609a0561ad0b88b72f2c99cbce0eff7f2e850641605fb71e
SHA5121195905ad481ea70c81297be296324fc56d9ae8843ee34b340b10ec450196d73cb5d9f89247d77ff53906993c6eccaeb9e5eea810865faedfe7f5784d5b70e63
-
Filesize
5KB
MD59d94e730388487a21ebba6ba3d103205
SHA1e0c6ff21651f662f814d56ee76084660d8ec8749
SHA25670c4355283754e5865aaf7c8f0a8d39a2cab48580d4924c90b80fb2ebf7e3072
SHA512d4da40306034b7af966a3bcb22242dcc5e2930819f9e7d96561aa94f1ba57c379c715e11c2b17c1a451c39d0da267f2be548f39cd1c618faf7ad3f3bd9596ff5
-
Filesize
6KB
MD5bfe4d5998b0f93ffeafb74f6470acfd1
SHA16489e4b4db6aef1a05b055bd87c199b77c825a8b
SHA256296a4cef271ceca12e4411a83dd72af6962159a0648ba5e552c1aaae7cf9e12f
SHA512a58fa05e93878ab3c112d14f89bd0779e2d5450c6cd09e8aed2cc7fedc48527db069e3687b6e3e515d47dc20117b46f74db26f6ce94ad6a5c940255993f5247b
-
Filesize
6KB
MD5a550c58591a079f3b813cc585c7589f2
SHA173913c9de56da9ff3b7a4c539fa5320908835aed
SHA256962b85194a009488b1a7d9be7aa4241c80af70850dac4daad9151006a8eefdb4
SHA5128036afa086112c26f092cecc8c455797f114b30ae7a594db077016a81c5210300002ff54dd2d84cb560e7ec00ec8af734c449259d55e2999a627eb2587616057
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
177KB
MD59069cd39933f718a2a46035eaab7b90f
SHA1560b433146946276a07a3aa983000ca331f9d259
SHA2563213ce89772b15235a49b7aea2d77cdc598a91e6efdd65f485456def20a0d212
SHA51207a7536bf370988565fb362afb50804d528cc2cf59d22882091d663cbb3e963f8e55a7b41b83f20de003e3f7af93c000006716ed68a6d5e68dcfa06b26f6bd73
-
Filesize
354KB
MD52275549af10da969ab3a0de11523cba5
SHA13440facb7d8295384433a042d92f7da182b470e2
SHA256081c80e04c2b8cfa9b3b06d7145289d87764647209434b9749168cc6daad375d
SHA512a2f87509674597c15299e8144fa7707aceb662d8c09fad8be4ded0b66cdf321e72b07aef2f4876453fbf50fe02126929e85eef40c6411fa06abc3476c9835671
-
Filesize
300KB
MD597eb7baa28471ec31e5373fcd7b8c880
SHA1397efcd2fae0589e9e29fc2153ffb18a86a9b709
SHA2569053b6bbaf941a840a7af09753889873e51f9b15507990979537b6c982d618cb
SHA512323389357a9ffc5e96f5d6ef78ceb2ec5c62e4dcc1e868524b4188aff2497810ad16de84e498a3e49640ad0d58eadf2ba9c6ec24e512aa64d319331f003d7ced
-
Filesize
751KB
MD5c281afd76e71557e53a1b90a42a30c0f
SHA14531733877d48ccef6d63c8834776dfb9d2c412d
SHA2566fd0cfcb7c15612d415a89901bffd3187792056c963ceba586a1359b0aa88971
SHA5123c25bd4b72190144fcd419048a1fdeb2adb0d44e53673268b73d3056151fb53a7b7072e5ea8f072b39ca3132ca02b3e328c65a8eb4370c323b11743cc17144bf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
120KB
MD5f1e33a8f6f91c2ed93dc5049dd50d7b8
SHA123c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
SHA2569459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
SHA512229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5
-
Filesize
19KB
MD5b56d69079d2001c1b2af272774b53a64
SHA167ede1c5a71412b11847f79f5a684eabaf00de01
SHA256f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
SHA5127eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8
-
Filesize
19KB
MD55af784f599437629deea9fe4e8eb4799
SHA13c891b920fd2703edd6881117ea035ced5a619f6
SHA2567e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
SHA5124df58513cf52511c0d2037cdc674115d8ed5a0ed4360eb6383cc6a798a7037f3f7f2d587797223ed7797ccd476f1c503b3c16e095843f43e6b87d55ad4822d70
-
Filesize
19KB
MD5e1ca15cf0597c6743b3876af23a96960
SHA1301231f7250431bd122b12ed34a8d4e8bb379457
SHA256990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
SHA5127c9dacd882a0650bf2f553e9bc5647e6320a66021ac4c1adc802070fd53de4c6672a7bacfd397c51009a23b6762e85c8017895e9347a94d489d42c50fa0a1c42
-
Filesize
19KB
MD58d6599d7c4897dcd0217070cca074574
SHA125eacaaa4c6f89945e97388796a8c85ba6fb01fb
SHA256a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
SHA512e8e2e7c5bff41ccaa0f77c3cfee48dac43c11e75688f03b719cc1d716db047597a7a2ce25b561171ef259957bdcd9dd4345a0e0125db2b36f31698ba178e2248
-
Filesize
21KB
MD51d75e7b9f68c23a195d408cf02248119
SHA162179fc9a949d238bb221d7c2f71ba7c1680184c
SHA25667ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
SHA512c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d
-
Filesize
19KB
MD533a0fe1943c5a325f93679d6e9237fee
SHA1737d2537d602308fc022dbc0c29aa607bcdec702
SHA2565af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
SHA512cab7fcaa305a9ace1f1cc7077b97526bebc0921adf23273e74cd42d7fe99401d4f7ede8ecb9847b6734a13760b9ebe4dbd2465a3db3139ed232dbef68fb62c54
-
Filesize
28KB
MD5487f72d0cf7dc1d85fa18788a1b46813
SHA10aabff6d4ee9a2a56d40ee61e4591d4ba7d14c0d
SHA256560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
SHA512b7f4e32f98bfdcf799331253faebb1fb08ec24f638d8526f02a6d9371c8490b27d03db3412128ced6d2bbb11604247f3f22c8380b1bf2a11fb3bb92f18980185
-
Filesize
20KB
MD554a8fca040976f2aac779a344b275c80
SHA1ea1f01d6dcdf688eb0f21a8cb8a38f03bc777883
SHA2567e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
SHA512cb20bed4972e56f74de1b7bc50dc1e27f2422dbb302aecb749018b9f88e3e4a67c9fc69bbbb8c4b21d49a530cc8266172e7d237650512aafb293cdfe06d02228
-
Filesize
25KB
MD5120a5dc2682cd2a838e0fc0efd45506e
SHA18710be5d5e9c878669ff8b25b67fb2deb32cd77a
SHA256c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
SHA5124330edf9b84c541e5ed3bb672548f35efa75c6b257c3215fc29ba6e152294820347517ec9bd6bde38411efa9074324a276cf0d7d905ed5dd88e906d78780760c
-
Filesize
821KB
MD5f4981249047e4b7709801a388e2965af
SHA142847b581e714a407a0b73e5dab019b104ec9af2
SHA256b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233
SHA512e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13
-
Filesize
32KB
MD54424baf6ed5340df85482fa82b857b03
SHA1181b641bf21c810a486f855864cd4b8967c24c44
SHA2568c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
SHA5128adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33
-
Filesize
4.0MB
MD5d2a8a5e7380d5f4716016777818a32c5
SHA1fb12f31d1d0758fe3e056875461186056121ed0c
SHA25659ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7
-
Filesize
1021KB
MD54e326feeb3ebf1e3eb21eeb224345727
SHA1f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA2563c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
SHA512be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67
-
Filesize
25KB
MD5b99a85f8ca740de99e7be9e48ec3b583
SHA1957f9e3118643940e34890ef93331853583278bf
SHA2569e3cd0ec2efeaf37b93aa63c995ebbe8bc5c57fc91a693e8d82ab2e6066e07f3
SHA51238fafc87cc391092b9d05faf4d81eb3b2ca4cb618fba75165b12a4a620945de69ed4faa2e042e0a8d166d399dd9f71095da887293f9ff5bc80e2d6845e0998e1
-
Filesize
5.6MB
MD5d9ae4ab7e356e38950359025308c78f9
SHA14b3ddd44f69c2aa575a1f0ecb96e0050002f16d3
SHA256c1b55b6f15c2ae193752a3ea651033224962002e8e67020e4d71229af64126ab
SHA512a5816eb10f4894b5989b4eace3d9dbd6d08897ffb22225bd1aef9f5415b0c5c3d4ac1c44885369e7539368c4f879d80082fdccd394d94161cebf38effe884340
-
Filesize
1.3MB
MD5a4327898c6814b4c3abfff706d1190a1
SHA1e77787afb0ef28c577f133c5df3afa6f6235d83f
SHA25606d0ec937e36ab2c995ee8fda4ea3299dcd5764c31ed4d6248f12d7d709e11a0
SHA512f211a015cfddee4ad2eb68221ae277368f7d2091d4ffe450ca3c3c9ed0b6ea6f44a57b9e8918a2f9ed89018748858eb150138df7a36462aa9e9cf1688220c852
-
Filesize
19KB
MD5f0c73f7454a5ce6fb8e3d795fdb0235d
SHA1acdd6c5a359421d268b28ddf19d3bcb71f36c010
SHA2562a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
SHA512bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e
-
Filesize
19KB
MD57d4d4593b478b4357446c106b64e61f8
SHA18a4969c9e59d7a7485c8cc5723c037b20dea5c9d
SHA2560a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
SHA5127bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b
-
Filesize
19KB
MD5d6ad0f2652460f428c0e8fc40b6f6115
SHA11a5152871abc5cf3d4868a218de665105563775e
SHA2564ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
SHA512ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22
-
Filesize
19KB
MD5eab486e4719b916cad05d64cd4e72e43
SHA1876c256fb2aeb0b25a63c9ee87d79b7a3c157ead
SHA25605fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
SHA512c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d
-
Filesize
20KB
MD522bfe210b767a667b0f3ed692a536e4e
SHA188e0ff9c141d8484b5e34eaaa5e4be0b414b8adf
SHA256f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
SHA512cbea3c690049a73b1a713a2183ff15d13b09982f8dd128546fd3db264af4252ccd390021dee54435f06827450da4bd388bd6ff11b084c0b43d50b181c928fd25
-
Filesize
23KB
MD5da5e087677c8ebbc0062eac758dfed49
SHA1ca69d48efa07090acb7ae7c1608f61e8d26d3985
SHA25608a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
SHA5126262e9a0808d8f64e5f2dfad5242cd307e2f5eaa78f0a768f325e65c98db056c312d79f0b3e63c74e364af913a832c1d90f4604fe26cc5fb05f3a5a661b12573
-
Filesize
21KB
MD5633dca52da4ebaa6f4bf268822c6dc88
SHA11ebfc0f881ce338d2f66fcc3f9c1cbb94cdc067e
SHA256424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
SHA512ed058525ee7b4cc7e12561c7d674c26759a4301322ff0b3239f3183911ce14993614e3199d8017b9bfde25c8cb9ac0990d318bb19f3992624b39ec0f084a8df1
-
Filesize
20KB
MD543bf2037bfd3fb60e1fedac634c6f86e
SHA1959eebe41d905ad3afa4254a52628ec13613cf70
SHA256735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
SHA5127042846c009efea45ca5fafdc08016eca471a8c54486ba03f212abba47467f8744e9546c8f33214620f97dbcc994e3002788ad0db65b86d8a3e4ff0d8a9d0d05
-
Filesize
19KB
MD5d51bc845c4efbfdbd68e8ccffdad7375
SHA1c82e580ec68c48e613c63a4c2f9974bb59182cf6
SHA25689d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
SHA5122e353cf58ad218c3e068a345d1da6743f488789ef7c6b96492d48571dc64df8a71ad2db2e5976cfd04cf4b55455e99c70c7f32bd2c0f4a8bed1d29c2dafc17b0
-
Filesize
23KB
MD521b509d048418922b92985696710afca
SHA1c499dd098aab8c7e05b8b0fd55f994472d527203
SHA256fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
SHA512c517b02d4e94cf8360d98fd093bca25e8ae303c1b4500cf4cf01f78a7d7ef5f581b99a0371f438c6805a0b3040a0e06994ba7b541213819bd07ec8c6251cb9bb
-
Filesize
25KB
MD5f22faca49e4d5d80ec26ed31e7ecd0e0
SHA1473bcbfb78e6a63afd720b5cbe5c55d9495a3d88
SHA2561eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
SHA512c8090758435f02e3659d303211d78102c71754ba12b0a7e25083fd3529b3894dc3ab200b02a2899418cc6ed3b8f483d36e6c2bf86ce2a34e5fd9ad0483b73040
-
Filesize
21KB
MD52fd0da47811b8ed4a0abdf9030419381
SHA146e3f21a9bd31013a804ba45dc90cc22331a60d1
SHA256de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
SHA5122e6f900628809bfd908590fe1ea38e0e36960235f9a6bbccb73bbb95c71bfd10f75e1df5e8cf93a682e4ada962b06c278afc9123ab5a4117f77d1686ff683d6f