Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
16/12/2022, 14:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://x3a0u0h29tw3jn5cyzz6tkgiefh-my.sharepoint.com/:o:/g/personal/jamie_williamson_gemcorp_us/EqO9XjnjVs1Dk3_JrWdZR6kBnbsr6-n_-xumZkfVT9dPSg?e=NfNigJ
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://x3a0u0h29tw3jn5cyzz6tkgiefh-my.sharepoint.com/:o:/g/personal/jamie_williamson_gemcorp_us/EqO9XjnjVs1Dk3_JrWdZR6kBnbsr6-n_-xumZkfVT9dPSg?e=NfNigJ
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
https://x3a0u0h29tw3jn5cyzz6tkgiefh-my.sharepoint.com/:o:/g/personal/jamie_williamson_gemcorp_us/EqO9XjnjVs1Dk3_JrWdZR6kBnbsr6-n_-xumZkfVT9dPSg?e=NfNigJ
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0BEF8E1-7D4B-11ED-A03D-460E09B1FADA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602e07cb5811d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebc8f7e30ba8f94aaba741c0e5bebdfa00000000020000000000106600000001000020000000a6944192406612d8205a096dba9fd56b762e63cc0c050ee9bb9257da6f5b61d1000000000e8000000002000020000000348adee999c0856905d2f5b523fbbe54e9b64bafd29a6cbe6a81467e06b1acd42000000017be35375c6e875b6c3a1481f488235a6d68d641d366125441daa8aac7c441e2400000008c7f6d4beb151335526a6e35397ebea98d5b3030e49e90ca7196831ff7c18510213656cfa215f26ce3e0f60236dd1fc5db3fd2fdd8717638efe86ca581734c7b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebc8f7e30ba8f94aaba741c0e5bebdfa00000000020000000000106600000001000020000000f43eeee8383a961e34765e5fd473f64d630b1395b2036a0c2a4dbe6b17b300c7000000000e80000000020000200000002d1d80d28becc6fff62f90bdcaf8e2fe0cc40c8ac78a49fdf09c89a7b847b3d890000000ab2d41fc3a280cec70ecb1180b70fb12ac11104289035ad276aaf2d996c577d3ae297f832f814f7b38698f7e7180b402bc23e7d091225f29b9756874fd87eca1987234579f3116d962a949c7685c3d1eac3b27eca80c7874b57f841ef7f6720762116bbc0cfdb6224835a3671f7fbe4f984d1e14b9a5d4ad9eb019876a8d25e7376f28e6c5560f6bdec443de0bdd227b40000000e83bd824f02ebaa05b9f3e00d056c395679926524e7a60104288fb025f51084a6e87b898aed06434fb60157f2d65290e80ce30ac1bc9e3caee07d5967bfe6034 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377965038" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1976 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 672 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1468 iexplore.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe 2016 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1468 iexplore.exe 1468 iexplore.exe 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1468 wrote to memory of 672 1468 iexplore.exe 28 PID 1468 wrote to memory of 672 1468 iexplore.exe 28 PID 1468 wrote to memory of 672 1468 iexplore.exe 28 PID 1468 wrote to memory of 672 1468 iexplore.exe 28 PID 2016 wrote to memory of 1968 2016 chrome.exe 31 PID 2016 wrote to memory of 1968 2016 chrome.exe 31 PID 2016 wrote to memory of 1968 2016 chrome.exe 31 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 772 2016 chrome.exe 32 PID 2016 wrote to memory of 1976 2016 chrome.exe 33 PID 2016 wrote to memory of 1976 2016 chrome.exe 33 PID 2016 wrote to memory of 1976 2016 chrome.exe 33 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34 PID 2016 wrote to memory of 1892 2016 chrome.exe 34
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://x3a0u0h29tw3jn5cyzz6tkgiefh-my.sharepoint.com/:o:/g/personal/jamie_williamson_gemcorp_us/EqO9XjnjVs1Dk3_JrWdZR6kBnbsr6-n_-xumZkfVT9dPSg?e=NfNigJ1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f74f50,0x7fef6f74f60,0x7fef6f74f702⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=992 /prefetch:22⤵PID:772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1252 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1728 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:12⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵PID:368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3372 /prefetch:22⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3608 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:82⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:82⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:12⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:12⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=536 /prefetch:82⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=984,14766312506508042921,11347931575393652912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3352 /prefetch:82⤵PID:2680
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1
Filesize471B
MD578a97fd9eaa7a9f59ee79a35887c7bf4
SHA159de3608a27baa6f3b8bcf42c621b3d92f226f61
SHA2564fb413644bcdb50e3abf6132ff96a72c6ac3de3628316b00c2735e3207ad0a73
SHA51271d27ce66dd320311dad8d96c8855e616092260f69be571f11a900f69b53c074900b2896d51c859b12ff41b6e2073de43247de9090903863e6800bd7e2351153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1
Filesize430B
MD56141fd2cda4e046a77eaf792c768f6b7
SHA1d076d76344fda52a50e109a9bfa1a157f8564464
SHA2560cd3bee9387ec06280ccc9835174b774bf1423451c26e177d02daf819d5b82af
SHA5128204751f2f9e3938024ea308fe7b4dcee404142577addfa86ea34376c835eda210e7b67e065040ecab79beb280c48f4b0ddd166973b6d4525e0f5aabc63b1b98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a344aebe8bc261d7a2b9146bb6831b56
SHA17c190c55f5c232dc6409ba8fe2b75193d0077969
SHA256a982f22f1f09b110b2928fe67918fd2cf89c317265589164879228c0facc2094
SHA512b15f33162d54be770c044fac2a57dd8ce35248162d7b29e1270515b6dff4f194caa0df39bfc609a9c4b516f4d9d9daebd08eda51128060180549941fb17e9846
-
Filesize
12KB
MD5282d068040b761fa4926c4b6631e389f
SHA1b3a581a9573729521ed52ce5951d196952a3f89c
SHA2564e326f1b9c942754c06aeda4ffbe9dc8e72a05250b9679bc9f44aca7edfcec87
SHA512ea78f6c2491c10e60e750cab15ff7a2bb58958c147b4c8f08fc92177cafef24dda85ed5fdf668a538ee571ae846d823bb48c00c2687d98e4168d982681b5b225
-
Filesize
608B
MD5e0da256965be0dbba86914bec3b17d44
SHA1749c5e7d971b3180958101117b48eab5371de573
SHA256e09bfe6412348afc25aa5f57e6e3b60987ad6d1ff6d93a3221b7d9c01683d599
SHA512d0af3a037f9e235955d9df18844c79ef8acfe107f0a2359a531e1f0f0071fed3e69f736afbc634c55c41938e307bc254663e8ba35bafb97b6aeba49a27e4ceb7