Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

9

Release/Bo...er.exe

windows11-21h2-x64

10

Release/au...in.dll

windows11-21h2-x64

3

Release/au...al.dll

windows11-21h2-x64

3

Release/au...ts.dll

windows11-21h2-x64

3

Release/lo...ng.dll

windows11-21h2-x64

1

Release/lo...ng.dll

windows11-21h2-x64

3

Release/lo...ng.dll

windows11-21h2-x64

1

Release/lo...er.dll

windows11-21h2-x64

1

Release/lo...-1.dll

windows11-21h2-x64

1

Release/ru...er.dll

windows11-21h2-x64

1

Release/ru...er.dll

windows11-21h2-x64

1

Release/ru...er.dll

windows11-21h2-x64

3

Release/sc...Dex.js

windows11-21h2-x64

3

Release/sc...eld.js

windows11-21h2-x64

3

Release/sc...Env.js

windows11-21h2-x64

3

Release/wo...re.dll

windows11-21h2-x64

1

Release/wo...pet.js

windows11-21h2-x64

3

Analysis

  • max time kernel
    203s
  • max time network
    203s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/12/2024, 15:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll

  • Size

    125KB

  • MD5

    eeb1d1ea9fc3f870f292161cfa79850d

  • SHA1

    ea4f4324245f9f4d6280ef285151f688221d6023

  • SHA256

    149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c

  • SHA512

    795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254

  • SSDEEP

    3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Release\locales\resources\app.asar.unpacked\node_modules\get-fonts\binding.dll,#1
    1⤵
      PID:3284
    • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\OutSend.pps" /ou ""
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5032
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=118051B4C408BB0B0E7DEA362760D50A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=118051B4C408BB0B0E7DEA362760D50A --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2040
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C64AC0EBDC7BD2B227F23102826B6E06 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1716
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7BFAE4C462DC0F53C40C4336462288AD --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2820
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36D68EBA6CA0C06D59459D93C7CDAF56 --mojo-platform-channel-handle=2064 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          3⤵
          • System Location Discovery: System Language Discovery
          PID:236
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=926F04C0D0940AC09486BBDCAC5273D5 --mojo-platform-channel-handle=2148 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3268
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F64A17CA66D232610057F1B97CFC0881 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F64A17CA66D232610057F1B97CFC0881 --renderer-client-id=8 --mojo-platform-channel-handle=2376 --allow-no-sandbox-job /prefetch:1
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1228
    • C:\Windows\System32\CompPkgSrv.exe
      C:\Windows\System32\CompPkgSrv.exe -Embedding
      1⤵
        PID:1112
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
        • System Location Discovery: System Language Discovery
        PID:2964
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        1⤵
          PID:3852
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            2⤵
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:4980
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4386ba0f-80c2-4ba1-8b1f-035372421bf8} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" gpu
              3⤵
                PID:2644
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8a2c363-b4b0-42ef-b441-b404621bec69} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" socket
                3⤵
                  PID:2100
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3100 -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3036 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d9b9ace-3422-4356-b1bf-88cf10f002ad} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                  3⤵
                    PID:3064
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3692 -childID 2 -isForBrowser -prefsHandle 3972 -prefMapHandle 3968 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63fa4312-e1aa-47c8-8b12-c90b85e9519c} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                    3⤵
                      PID:3968
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4896 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4888 -prefMapHandle 4884 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19a0a6de-1369-4808-8235-83aea116a4f0} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" utility
                      3⤵
                      • Checks processor information in registry
                      PID:5144
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5364 -prefMapHandle 5316 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3db2adf3-bfb1-4784-8512-097524b2ecf3} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                      3⤵
                        PID:5696
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5508 -prefMapHandle 5516 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49327958-27d4-452a-a13b-148b57e2fab9} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                        3⤵
                          PID:5708
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 5 -isForBrowser -prefsHandle 5684 -prefMapHandle 5688 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4b95097-a381-4294-8037-24c4e7cda121} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                          3⤵
                            PID:5720
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 6 -isForBrowser -prefsHandle 6096 -prefMapHandle 6100 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73f711ad-8e18-4b23-ba7f-e3a11914e3ff} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                            3⤵
                              PID:4584
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3508 -childID 7 -isForBrowser -prefsHandle 6376 -prefMapHandle 2748 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73e4c840-4b6e-43b0-af6d-c562dfb537dc} 4980 "\\.\pipe\gecko-crash-server-pipe.4980" tab
                              3⤵
                                PID:4304
                          • C:\Windows\system32\BackgroundTransferHost.exe
                            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                            1⤵
                            • Modifies registry class
                            PID:1556

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                            Filesize

                            64KB

                            MD5

                            5544b11dce289d065bc8a957a8ff6657

                            SHA1

                            3dded95eb173ff029efefc2f6c37f50b5f6ec88a

                            SHA256

                            18e5df353686a9afe6b60c61cb005055526c92e4c4255f56b12b3f8af1491911

                            SHA512

                            13bf59284302fd8ef6a77e6dd945249af96c31565f728d80e0579cc6265d5586f0c53317099b4a0f5b202c3b625b23b1eba31c4a19e23dd7380dd5248c28b5f8

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                            Filesize

                            36KB

                            MD5

                            b30d3becc8731792523d599d949e63f5

                            SHA1

                            19350257e42d7aee17fb3bf139a9d3adb330fad4

                            SHA256

                            b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                            SHA512

                            523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                            Filesize

                            56KB

                            MD5

                            752a1f26b18748311b691c7d8fc20633

                            SHA1

                            c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                            SHA256

                            111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                            SHA512

                            a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\activity-stream.discovery_stream.json
                            Filesize

                            18KB

                            MD5

                            40fe2df8ce62ea3e2162c3690149acce

                            SHA1

                            2e88a33d962654c0bbdfbfa1f2adea0b72e87faf

                            SHA256

                            bf7ce36701bf8067407ce41c4f534aca635c5405297c59d5b4b7e7a23050425f

                            SHA512

                            3a6bb736139e66cdd5603787d7119d59161683076b8625f93aad3470eef37228ac2c8ee153e19b52296cd12510a481831f6a72fb752284e02675f3cee79b1222

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\cache2\entries\0496E33B07BB9340090B6FF9A653DA5443DBD403
                            Filesize

                            224KB

                            MD5

                            a6e1be226fe803069e1f2b2565d7f4c0

                            SHA1

                            2e8d8eba05bc986a7a16df4ff7796fe4fd5819a8

                            SHA256

                            0eb74b7575042fb28fa38b026b45f01137ea179d38466137c3f5e88e7df6044b

                            SHA512

                            dc4663c5d0d0e8f247f9022a8793817fb295f247b3674f3b94bbb1b07562b41e918799c0fa89740122ba923ce7cc0bb1db98c385797e377b671533d1f290dd02

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                            Filesize

                            15KB

                            MD5

                            96c542dec016d9ec1ecc4dddfcbaac66

                            SHA1

                            6199f7648bb744efa58acf7b96fee85d938389e4

                            SHA256

                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                            SHA512

                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\AlternateServices.bin
                            Filesize

                            6KB

                            MD5

                            948cdeb3d9aabfd2da3eaa98fbf6cb03

                            SHA1

                            1fb93ed0358eb24cd336a31086f6187209ae1e2f

                            SHA256

                            157474bd34e56321365b721ce07332a6e0fd80b6fc7d3ead4f9c5eb663fa39aa

                            SHA512

                            b121784b9f1f4fdd109f7afb264e3d80537bb967dc4308fc6eba89781a9b958434cb8c26943749bc712b79d2dc54d6a301ba66ed1bcd4db666eb8bbdaaf6c937

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            698319a042e4b512a0b4cdab0787944f

                            SHA1

                            53dab6c48d551ea0658120929a818ccd755ec983

                            SHA256

                            6d80cf8d4bbc16efb818ff45fb945bfb23a4fc308fac14aa41c1070fcf050830

                            SHA512

                            09ec73a38c038e2fd2661b76683d6a4dc0a3aa12fb10d669a59953618725a1b3ab1efb579d160d11ebe04f75018a3eff7160bf31fb5047b49693959607620901

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            7d9e47f904508bcf822bb2034e602bef

                            SHA1

                            9a9a6ad6150abc1eb3944f8fe8c24d9a8b6a57c6

                            SHA256

                            c8d2d46f2dadd06cc7c8824d67aba718dd633681ad363606c33f172d13c575d2

                            SHA512

                            36b1195ba818e644b7660bcad54ab6973f33fe5fc66a670007e343e26f23a8ff3e0cb99e5289d1baf211fac866f18068be7f17db95718f369bccb525ed8e71a3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\2e2b1be8-e2a8-49dc-8116-087a95d8534f
                            Filesize

                            671B

                            MD5

                            783838821e263c035099a6f211c6c7d8

                            SHA1

                            9a57cc21cac3e4b20f55386b6b2b55667f0b645f

                            SHA256

                            0e01a1ee118731b89b42a56f36cf42c14fc9e2138539fecf3af9df7dfbccda5e

                            SHA512

                            dc9ff70779969e3709ac2cc9b19711f30229f21bc1611ace6c684ec7761364aff73beda445b7de09e82773d4b41bd4a162f981da58cf4efd98330f0529ee0b61

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\467e2c35-2e96-4306-a20c-d66f363c2fd4
                            Filesize

                            982B

                            MD5

                            7367bb42115ab09c9536d6a6355fec15

                            SHA1

                            88b2b690d2b6e4b82a026461d3abd317cac91962

                            SHA256

                            25ffc91f8c6a1d1d0dd690aacab759a8b90028cc681897a86c59a0976397be7c

                            SHA512

                            bc740f553bfed620fd1cb11da1d5f50f5d53850974d0122fcbea9b0816361c1caee11de8715b929c5bad57f57bd36bf27d726fe8b057978ec449f6b4314dcecf

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\9001a43e-0c09-4073-8859-719d492a521b
                            Filesize

                            25KB

                            MD5

                            c193af606ad0e317474e010741316cda

                            SHA1

                            b364412e2b5cbab0ec8d9ab0ad3369196553da62

                            SHA256

                            945ed36e5cf4d64549a2618a029b58fa685a8435f22ea2f075db0dc6d85b2a4a

                            SHA512

                            e2205f4ff406bb3cb7dfe94a8530f6603cc97736c957944e77b70ecf6d561118b4c0cdbcf4d95eb1594827510445e07712cccdcf384d3716385147c11a356d83

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js
                            Filesize

                            10KB

                            MD5

                            8cb5122cd11af154fa6df27486faec4c

                            SHA1

                            76f8cca98bff6a229d1b599a763420209d5fa9c0

                            SHA256

                            2a99f6d27858f506dd341ac71461553c904023dc491f1b857cfc657575de7718

                            SHA512

                            2e77bc26fda04d4dc064fe0990e8d3f6e24048d4a6caaa50500d48930800d59e1fabdf22d58aca1761e09f7c6a5c7f73a1c3b5b49e07159df46645be2d69d064

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs.js
                            Filesize

                            11KB

                            MD5

                            602433a5e5e524fe441e19df81437bbe

                            SHA1

                            656c2aee428b6c749245da1308dbe5eb775b5e8b

                            SHA256

                            0e3a3e588f8c8157bf4e2fc238b0b3ea6141bef7db4f1d9ca2d5c83593bd8f4d

                            SHA512

                            2e360d3650a5797966f6e798418eefd90bf9f30e54d1c7cfe8ceb04c1d736ea4596139363c9f0b8c1ce3f4bc12031d644f211765361669d82f8bab149d85b684

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                            Filesize

                            376KB

                            MD5

                            ee6223a5eb16915d9383c2239c533564

                            SHA1

                            c45842a34512ca3e7a2d7859e9a514e8e2aaa91c

                            SHA256

                            dd51650abacd1d7a3954bb42eb0d3bbe990b95f62fa6dcdd72800b26c381ba37

                            SHA512

                            a0d098cf8e8128d70478274f31c46bb3c080a90ca966d114ddb6b3fbfdba770bbd0a2701bd0a264576e22971c66797a1fa10b7c8e4ce331cad653130a764539f

                            Download Submit

                          • memory/452-167-0x000000000D8D0000-0x000000000DA1D000-memory.dmp

                            Filesize

                            1.3MB

                            Download

                          • memory/5032-11-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-14-0x00007FFA6ACC0000-0x00007FFA6ACD0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-21-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-22-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-20-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-23-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-19-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-18-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-43-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-44-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-46-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-45-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-47-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-17-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-15-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-16-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-13-0x00007FFA6ACC0000-0x00007FFA6ACD0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-10-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-1-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-12-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-5-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-6-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-7-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-8-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-9-0x00007FFAAD600000-0x00007FFAAD809000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/5032-2-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-3-0x00007FFAAD6A3000-0x00007FFAAD6A4000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5032-0-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5032-4-0x00007FFA6D690000-0x00007FFA6D6A0000-memory.dmp

                            Filesize

                            64KB

                            Download