Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 13:10
Behavioral task
behavioral1
Sample
Free robux.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Free robux.exe
Resource
win10v2004-20250129-en
General
-
Target
Free robux.exe
-
Size
78KB
-
MD5
224ffc7642433a54523e38d9bd28a7b4
-
SHA1
45ce3d4b4161a916b6c3c1126fe19bf1a0ce9490
-
SHA256
e81c03f063eb81973ecbc690961658b9d613e1648c3612fbc1ffdd41fbf1f7b3
-
SHA512
1960f6a2bb79f258c0e78d056caf7a384eff84bd50439eff68a85cdedab416d2623607cc98351d457b5f2cb1e89096ca99a06b8210ec749dc44f050427ae1eb3
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPIC:5Zv5PDwbjNrmAE+NIC
Malware Config
Extracted
discordrat
-
discord_token
MTMzNDc5OTg4Mjg4Nzg4ODk1OQ.GYogWp.NMtpgtuN4Hf6PsEomIL-OoyUKqRkEVtf5alRts
-
server_id
1334800372321222707
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 134 5064 Free robux.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 20 discord.com 133 raw.githubusercontent.com 25 discord.com 73 discord.com 134 raw.githubusercontent.com 135 discord.com 137 discord.com 11 discord.com 24 discord.com 39 discord.com 72 discord.com 74 discord.com 75 discord.com 13 discord.com 35 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133828027284736310" chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1736 chrome.exe 1736 chrome.exe 3648 msedge.exe 3648 msedge.exe 4176 msedge.exe 4176 msedge.exe 4480 identity_helper.exe 4480 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 5064 Free robux.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: 33 3544 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3544 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5064 Free robux.exe 5064 Free robux.exe 5064 Free robux.exe 5064 Free robux.exe 5064 Free robux.exe 5064 Free robux.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 4416 1736 chrome.exe 94 PID 1736 wrote to memory of 4416 1736 chrome.exe 94 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 4948 1736 chrome.exe 95 PID 1736 wrote to memory of 2772 1736 chrome.exe 96 PID 1736 wrote to memory of 2772 1736 chrome.exe 96 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97 PID 1736 wrote to memory of 2536 1736 chrome.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Free robux.exe"C:\Users\Admin\AppData\Local\Temp\Free robux.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87e8546f8,0x7ff87e854708,0x7ff87e8547183⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:23⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:83⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:13⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:13⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:13⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:13⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4684 /prefetch:83⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 /prefetch:83⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:83⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13391203378094197788,3698015521327156599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff86c5dcc40,0x7ff86c5dcc4c,0x7ff86c5dcc582⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1880 /prefetch:22⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2220 /prefetch:32⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2472 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:1784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4744 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,2570419113643089019,4036222967911980988,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=5064 /prefetch:82⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3988
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3308
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x244 0x31c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58c76af55119b92d356d15ffe98a210d2
SHA12174c899beb83cbf2cd549ab430612e6ce769048
SHA256283bf58804c733f376bc9213e79bf126e9a9d05408e44edb991cf7f27f80906d
SHA51281ea3faa31bb90f3c5dd3d9b4b29844837942f7f55bbf61100736fd072018cc03caa448230a3fe438de7f52cd9ff0f23f3f1b2d7758b866b2b8c18f8e3171c9b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5de7c0f820981c1f80bd72fd9224ce14b
SHA17539d8dfbf1b7d61777d1058be85be11e9404079
SHA256acd4d3aeeabe08b723763dc80a1072929ff46e69e04d5ba63c6a9a4ee8c41e62
SHA512bee7bd1caf9b89205731509c4a4e64ba020c724c4c9cbd8102830b36ea5067745e0099cc2b2715c5e88c9cf6c1386db290e88d8f81ce3cb02ed7e72e356ca79c
-
Filesize
8KB
MD5a127b376b45d77f19a030bd59be75990
SHA12d7873c916afc377b003f4164e81cb77a3cae0a3
SHA256500a3356ef0be8e79df188bd6a3f3f7023fc55e0ead37d0804d31e49d924f4bf
SHA512d0baa05c7269e587ee0baad935c7df8b4101a5e16d0737d3f224bbe14bec849b9bc0a6da19454f74194ac3ba79835d98846298844c2689485e35e19c122dcbe1
-
Filesize
8KB
MD5de6897065bc94b93d5d696fb7c7a5bc2
SHA14ac1c448266e07a9c28b15c8a4b210995a6b2732
SHA25631ba85dad86b4edad8842508f571200f39617d6aaec3183c404f65d8028cdee7
SHA512d5ed5257d817cd04d07491d14583b7aa04e254f9177896641da5cf37323d38d4a50860f0677d4f6bb2e57c5abc72bbbf58827795838f08f5dce5c3dccb70f958
-
Filesize
15KB
MD5c784f472a9578f9ccf35c232720385c7
SHA1c1f8b4f00d856df1ff6fc4cf9d873dcd06475b28
SHA256d4c79b19bb96a4572775643a390c0d7dee38726a88209dcb326fe36dcbf3bb50
SHA512243c3ea506f03af8531417abc8f24b9be34f58636ac7460ef97a156ad5ef17d8a53d3de1a5c550b18bf75a5d5471693423c9c0c065579a473b6c18c314410fa9
-
Filesize
242KB
MD5ac83c7369c61901cd0a95db837a919e3
SHA164e3862fd9329217c5f95e39e2ccf9533e6d768e
SHA2567bd1ada028ae6c04900833c64c4aba501b92d447f11e02aabfd36cfac5293301
SHA5124c70878f0be41194d74053312279abf06a65ef545d392270bca991ef625a48b83685ca707854e9ca12b66636d8fd3969f4dbde6b321fa78a90705ef4d41120c3
-
Filesize
242KB
MD5ec3d154427958268f7e9c68556e4f006
SHA1f295b5cf0d62d81ccc85e97854d2e220363ed240
SHA256239509410ebb086a5c813195bb17bf1173b76880777c1a88a600a7d38c93538d
SHA512dfbfa0f2f773b43e2acd230072fa1235f3d588ffd7ccd9eedc99ed7085b40f90f2147b9663a8f7653d1c65c325aa640338482fcb41a0bfb901af05d890b2689b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
152B
MD5709e5bc1c62a5aa20abcf92d1a3ae51c
SHA171c8b6688cd83f8ba088d3d44d851c19ee9ccff6
SHA256aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e
SHA512b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24
-
Filesize
152B
MD5bc29044ff79dd25458f32c381dc676af
SHA1f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7
SHA256efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f
SHA5123d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD5bd3af1c2823c67ea40a0adf5c01e00e7
SHA158d394710be24774db8b802e1c6ae438cf8bfe5e
SHA2567b02ae3707221fa1d2d5a54970098173b1120a1d0aefc1df75a3c972de45de4a
SHA512e5a5020ede05a022c85500bf136c3120f51a27d9647ea9a3585a5dd0b005745b85f088719ef7597d95a3a1d4c1bb46b518da2e557aab6c250d9b824f0148c8ac
-
Filesize
2KB
MD50710d124cc5ff1e1abeccd651e6e9878
SHA1782b50f97e95d63efb900ba4b2b386534904d0ae
SHA25632a22975216479e28859228ce69918deac709e60e1f786b0a73e83d886ea2b50
SHA51207f59e2d4864adab45b476154e8a93dacd09a657982842ced4b527817c5ccaf8b4bd19dbbc23fe5431a628164014e2fece3f03392b30e1085d3f20f990ac7264
-
Filesize
7KB
MD5a187bf15cf3fe3e26e7a44d80aa259ac
SHA13f8943d52badfd8d35ada0dccb247e388e695296
SHA256ad97e218f2516a422b2fdfefdd1a22cc2ae09213b05966dab2dd1a71c7a47bfb
SHA51229afd125062eeb3a6c61d1ebecae960d42b1cdf0b633ae8a5daef506e4624bf2cce810444ca677dcf627af41328f3ae7baee0c92bb522d588000d2e159ab69f3
-
Filesize
6KB
MD5a6fbba73b9c8fb6186dfa6b16466e7af
SHA1334b5f98ff8d842e5aae23a38088f8b29802e66f
SHA256eb4f8c18ca136f7ac7301e26a610b19983852d90b597c5565a441476bc381422
SHA512ade95fccae9612aa5ff3c306000f9c7a6625312ed66f76117a1ff5f89b9bf5e7886241490134b76958c4ce1d05ff562b1f7a79b9bb07d1046270638bd6bd3641
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1ef7849a-0475-42a0-a455-1efe5182c235\index-dir\the-real-index
Filesize2KB
MD5472210a8475e680edef72aab6599d3c1
SHA15ce15190d20e10316af50350589d7d0b373d34b9
SHA2562c38ecaf24319e4b8db52b6380bc4efafd1799cdec1c767afcd266e364dd960f
SHA5127ad011ae8c40da6fb405ed9da0c97c4c037093bb7514870d7648b3e9b6c64a01535d84ed1c0356d71abfac30867f272f81dee390a69858d9e86f53efa6f816e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1ef7849a-0475-42a0-a455-1efe5182c235\index-dir\the-real-index~RFe599486.TMP
Filesize48B
MD5caff7ded3e71babf4ff4482ef4124f3c
SHA1c8e92fe61e4f4aa87a551ce9009dba5fc5566758
SHA2565060457ca4ba41fd83fbe635c3d9f7d08dc853ff6b2b1c3b15e80706a5fc34f3
SHA512171ca0ec3dc2e2b431b6c3eb63878290ffd8d9618be9f875fd614eea018e3fdeb3d43094f460c4bf112447c826886d8b5d15422c1c9da1a6738cff7a26de150e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD5fbc9dc6329393c3571dfccb0dcd05a63
SHA1e5d9413e6f95676830913ec777e44790e0c94eee
SHA25611a2d6520d2784ab856d59dd3034cab85688686a0e0f8dbcc652c499559947fb
SHA512fcf9d0472b0806fc3534a190ede8a8d3ba5b0276f53d187b695195b987473450028d2d6cadf6b5ac849c21cdf036a0e4b35b7f69aebf438bb2ecff35806b0bc1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize84B
MD5877922d78432177b66dda4f589f7ee7d
SHA184795a418c2bfd2906081c147914485ba4118210
SHA256a3c24fd4679d565e8f492ef9db66647758fcd809ffefff1e4753f3795ad6917d
SHA5123611d4049394749bfdbc53d3e635335e50c103fbb208a6df31a8715cc907e5450386c7f37922c2ff0038321db58f53246a3632e1c459b581d2d6ee250b92cf7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize89B
MD5ffdc1e57bf924a4b5bab1ac3a5f7d318
SHA1e32269f817159a382068b47068e7934ed85a86cf
SHA256d93d1ccab72d8817387e304ceadef5af455d310e1589018b76dcaadc50884414
SHA5120e9eacf3f3584b0df8e07c6d36eb753ba1ee149b172743e3ae7db7e0575b8f40819198044cf74ce8e4ea59ab57ec6550a7980b2b32810f04e30ff397df319d12
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD54ad9c82c2be39b50a6a4b43c8fe3c633
SHA166de221168f88dae1153540447394343d7dfbd52
SHA256460e1589a92e25edf68dac1b249877bacff0f18da05e4e1814d438fc4f56c971
SHA51224407e24fdc82ee816d9218f4e4606b55d0dd0e91b2bb4a7e069971ae29de1706ed291bebe0b30471e15cc9331496fe548e217ee1d5cfe125aae0a8e33267ed7
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize48B
MD505337bbee89b3ca3cc0a36c8eda145ac
SHA1168990cff707fae2f3f6b75ed87a307167396e40
SHA256e95a5768c60649c934e1ecf32ff3b408ebe8c7073a9e5cd6b6711caf63359145
SHA512a1360edd6a4dc29e9488da31656ba9741972565408141a94051a9502774d46faa1ed9383d348261b73b32e451b340ffec528c2388824dd2ef6ff17149d1e2625
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5994c4.TMP
Filesize48B
MD56370d4a28bee82d423ccb0f5dd0922b2
SHA1533fb5f214eeb519515310158712c213fd2d5726
SHA2563d7ba0837c479c0208a352332f9f18daa0946c98abf1d89e8578f442fd10578b
SHA512b734948c0fdbebe248b019f3a9cb7bb1f4ccdbbab6ec28f5b613e665d384bb74008e8617663de393ebbd38efcb6bbe6d9997c0cc86497f1b48ecfff89686a848
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD526f041a2b1ffbff9c32c6b5ee79c1c13
SHA18482ad2087fc601bba37371e8209c7acca87fe4f
SHA25650736d24b4c624f40994f8dc8361e0e9d5525490af9b34069a83d6e3e7e383db
SHA512a84e0930a281d259a2d335c5cf2d9d32e9182dcdc98c4ce6a2acfbcf1974ef2b247a83a7d60c560355aa58f1e4a190f4eae249ae760569acdaaddbde360ce8c9