hxxps://wecontrusmil[.]page[.]link/WoQJ

Analysis

max time kernel
116s
max time network
121s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://wecontrusmil.page.link/WoQJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fa8ec46402d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009f7ced1a997c94f9d8f1fb2f56a5bff00000000020000000000106600000001000020000000db5b8e8e49fe546c7bc51c6cc735e39d12b677e06c5365834b03dea8670a7905000000000e800000000200002000000002ba55a1b0ef3dacbb825f3bbb439c74ad9be4e4bbb19cee51b50cce305757cb90000000401449bd2bc17259758928ee7bca20c30f2c7acdd0bc686f9ac45c6c86fc7d60d3269be08f155834d68c913afd8f6bdfa582e85301ce33d8c3f8d75cd2caba7da07eccfc106564940fe18dc3255388bfdf31496390aa594af3629e3d587ad3b13167220d24b451771c9c0e35f0ed7a26aeb0091cc6bc57b34367dce18c2a96de2f02eceb47c1a082b1d20fbb6a57647740000000a64b146718d807e8bdb1a558c9119da8be02205d7ead173c4b646230fab200c30fabe82ebd7a48c194b5f13aed0bc3f5e3e6cd77bb2037a733ee9df4d0475b1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7E0C941-6E57-11ED-B25A-FE72C9E2D9C9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009f7ced1a997c94f9d8f1fb2f56a5bff00000000020000000000106600000001000020000000ed6484aeee2672c911ac92c993398a21d17d9544b1ec42f77121cb8c1a10de47000000000e80000000020000200000005cdfbf6af799f0713d3c8cc49f8b92290235c78327d5bc608615c515d6181092200000002165ef13d15bb4ef573426d1beed47d4631154e8264b838eef8827131ae412b040000000b95b0e18b2566638913151041b64b65a4b137b737ab79048219b6f0de9e806d874daad46432d5a52ba8bda541c75c25ade8afaed4d45b38693639638610ec3cd	iexplore.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1652	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
684	iexplore.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
684	iexplore.exe
684	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1240	684	iexplore.exe	28
PID 684 wrote to memory of 1240	684	iexplore.exe	28
PID 684 wrote to memory of 1240	684	iexplore.exe	28
PID 684 wrote to memory of 1240	684	iexplore.exe	28
PID 1852 wrote to memory of 828	1852	chrome.exe	31
PID 1852 wrote to memory of 828	1852	chrome.exe	31
PID 1852 wrote to memory of 828	1852	chrome.exe	31
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 2044	1852	chrome.exe	32
PID 1852 wrote to memory of 1652	1852	chrome.exe	33
PID 1852 wrote to memory of 1652	1852	chrome.exe	33
PID 1852 wrote to memory of 1652	1852	chrome.exe	33
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34
PID 1852 wrote to memory of 1600	1852	chrome.exe	34

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://wecontrusmil.page.link/WoQJ
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefa994f50,0x7fefa994f60,0x7fefa994f70
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1096 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3284 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,7250829671872125216,2047590442576589799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1480 /prefetch:8
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
6639eb1615140cb765d60da56623de3e

SHA1
4eb71b48df96868a741eb80913acb9ffd022a89d

SHA256
b5d1cd8dd63ac99b9c47e157187621fbf2e6566a8e6d96b9e17c16759f2846b6

SHA512
1156c3f805bfead9f2265b4a5c01ec7bbac8318918115fb53a0865c4857f558a411255f34a099b09b9ec9c2af8ecc2e1301efc9f7e20b63c2454fe15056902d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
05f7bf88033198e3e8a17bb18181c284

SHA1
79f25ba7c4d0201afa52520b8116843ed5283717

SHA256
c1c83e400d3ea0543bd1a37834c148d1655011f94f201241fe11c02adb4b775d

SHA512
480487cd31618843159fe70e8315ed4635576dfbf4665281fd81d0561a38b224b21241ce2013ae473bfba04f0b2eb04137dfa351d94049225b29b008a0c82573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_69BCF5AFBEE67171EB2246040EAC51C8

Filesize
279B

MD5
99fee525c43bb2eccdf96775872c174f

SHA1
fb9444b5024a100b6c62dd72098f93b548ed14c0

SHA256
949ff0ad176b5e77f88d82a4fd4e123c5b399548461637cbc3f1f1b918326573

SHA512
9dc4046673a5df6677c5b33c579f55346493df43fda3e7ef658d465974baba4efd5464a35ced5f2bfbcd0ded58e89e3ed4f8daae2799819737ef8d883fd1ea46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_1EC3998735CF104B8221FFB8AD4B80F3

Filesize
472B

MD5
3a1eb1b0faeb00e2c129b3e3990a2c89

SHA1
4fa8bb12887014105e7e4982284dfbccad830db0

SHA256
31d22f4d2efe8e818073ebf1eb40c493597b9c2fea4b865dbae2e36acff18d50

SHA512
833db8ef51cc1b2fdaab4cb14751f2b1e55acd2394b7c4edc048be1b5d333f3d190f2f19ffe46b112b519290b4b49efcfe7f9f060136a3127ab7ebfa76d36d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
15279e176c12132b3866d5a85547cde8

SHA1
52364925cb8517902b9328b05ae6bafc6dfb1b95

SHA256
e460d6d55ccb46be5c0608a7a078187e87232e2f895207f9dce31a1aad3543f1

SHA512
47f9f159d7b3881b34ef8304b76a19990d65f4e400e1b6a13cd20fe8c12a096dc34c1392416ae0245e66a4e3718569176dad6a77410662ec4bfd7a4715b6ef43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
0e6289a61c78322e07532079bd4e2a0b

SHA1
30e9992f387c306aea91b37fa37e14d06042e8d0

SHA256
1d44ff378182daf411c239c833359181038ec288e7b32213f9766e6d954ac3a2

SHA512
6f86cad6ae74df4a7c8338ea8edb342dd98fe54f6ed9ef4d9b8db00689761202d6671980bf67578120166cf83ae5663d0a0768815eca6808ce9127d17e6071a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
713d4e5d350834d09ac57e2066125f7c

SHA1
611ea3b930cf10c9b923b965832db653ac85afbd

SHA256
1f7de4d0ef1bcdf2301c8bab11ea1bea227fcf1cefd383e3a188f38a1518d4c3

SHA512
e521a09149336f2d7e20b55d679f05c7ee6558c8f90694a564e115f7245afb1bf01ed0f2ba5242fbac8ee11ccf0029fd087d7224e89439d5917820d6840377f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_69BCF5AFBEE67171EB2246040EAC51C8

Filesize
426B

MD5
47142d7ff96e0f48cfebf425b7fbeca3

SHA1
825e471276d3e48939fcd1ba942940a50ecae169

SHA256
b9939ce546daba4df724fc990f0737b690bb5a78cf51d467c1b347097fb650f5

SHA512
7601efa8308c3c973945ec2f45132d99e186f464cc72c80cf2da26668c71b97a9a6f0f1aa994d4837ff4880af5a80288906f077d3cc4bb52000719674b92da81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
cb8e6f913945c53b6499e59ef971f884

SHA1
90b12d93eadbe9a3a1b3026ff86f7063fe73e118

SHA256
380b4e974fc76d7d19172ed440843d11555d888cb6707b898ec9295ac35f7fc4

SHA512
8bcbd6f03a8a5262673dc702f3d694c19c2e586d0fdfa7084232e24c88a2539011f91cee0743a58cdbf78d89688bbc59b86f51bb86d537b9ee28291adb829958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_1EC3998735CF104B8221FFB8AD4B80F3

Filesize
402B

MD5
6bbcba844b0d6823d6d2bb1db23a8065

SHA1
d019a97bafafea9673fbcb3ffaaa6040c3e7299a

SHA256
f201152d187193dd7e57a09cfabe5b3cd688e76df4c9ddb90beea53cd00912ac

SHA512
7e393f0ddada502f81f6d77eb1bc3cf925beb4c70f86d205890f51c10d5d53ed6d6598406c9506b91e5468ff6c94cd79863fbb11b46899ea8e13fe92f094c78a

Download Submit