Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09/01/2023, 21:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.southpark.lat/
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
https://www.southpark.lat/
Resource
win10v2004-20220812-en
General
-
Target
https://www.southpark.lat/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000005eb34dfd61f16a3186939bbd9d3b383a9353c4402e0746a7113a0424a58b4c46000000000e800000000200002000000055acbcb795d6a72f0670d7a841a2f005ea45b357fdea506d833a034b97fc4d752000000073a4975b2110455203fb1769748dbfd4240336d219f608ab4d40691cc094ec9940000000352d1f9c0f7f7b2466877d48ac035d77992187eeee7db5ba7d64c4d2622c730171a9ba28e54c9a9085a88dcabe44c430ca97d6534e1bd18521bc1a39cef912d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80728e157924d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000001e6d5db724e779c3c517fd23eb61abfb4f324ac4e11ae3baa73aa7dc96519a73000000000e8000000002000020000000c9030a4b9232c2c728db5ff2cd75ff2da1d45d02bdbf2784d17368671b5b8be390000000521bd8607ea6e28c64178731fed4808064bf3b2ce4c5a444b6045d7bcfd3e2fe25b11e43830d10538e32e37fa192e0b0e1b6a815e24a8b134c68d78080966fc01c7bf0994e60a5cfbb205d20c584a330c2123292b8b5fde9e2890bd30225a5aa80acd754817dafbd8072adc8084177156c4cd8161e9323f2454aa3cddfe9d526457a0652e034fc54682f5244736d0ccb40000000b24bd5826cefae257303cbad3337f33f140ac0b2d9bd9fdf8ace1fa24dfe7287247ea6bfdb5d57caab00deb57d19d2002864b25d6c320488a5775cff2da3b5a7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380067981" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C601171-906C-11ED-90DE-EEBA1A0FFCD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1556 chrome.exe 1152 chrome.exe 1152 chrome.exe 2496 chrome.exe 2504 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1996 iexplore.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe 1152 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1372 1996 iexplore.exe 29 PID 1996 wrote to memory of 1372 1996 iexplore.exe 29 PID 1996 wrote to memory of 1372 1996 iexplore.exe 29 PID 1996 wrote to memory of 1372 1996 iexplore.exe 29 PID 1152 wrote to memory of 1060 1152 chrome.exe 32 PID 1152 wrote to memory of 1060 1152 chrome.exe 32 PID 1152 wrote to memory of 1060 1152 chrome.exe 32 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1936 1152 chrome.exe 34 PID 1152 wrote to memory of 1556 1152 chrome.exe 33 PID 1152 wrote to memory of 1556 1152 chrome.exe 33 PID 1152 wrote to memory of 1556 1152 chrome.exe 33 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35 PID 1152 wrote to memory of 1644 1152 chrome.exe 35
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.southpark.lat/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65f4f50,0x7fef65f4f60,0x7fef65f4f702⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1192 /prefetch:22⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1688 /prefetch:82⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:12⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:12⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3204 /prefetch:22⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3480 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:12⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1144,12343723961137707011,15526909444276822389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2928 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD553c42b70e0cb733bdd116eb57c817db4
SHA1dd4cec8273ece07b776f2e67e8bcb3c625fc7188
SHA2568e8c03a9808c3207049fd5eb462af3a715fef5f8718aec09536a0edef8bb5e8b
SHA5128ad73d9df2d476f8482f5eb86b2ace7a7583974b790c999e43980c583400f3a332d7e5a8031c7664966445b75a867465dbf8db8d380b22524db42c9bd734a560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5670f5456aaf5f60afbf8ef50ffbd3123
SHA1b0a7232e4087a924d8109f9f63697e7e710057b1
SHA256c6c52527fbd9b9659788b026aa0ee73f68e223c377dee5ce0654c0dd86c9478d
SHA512828d77eb276ded530ea086fbc2b301ba734ef75389eb7dd57ec636d690e4edb5a30f8bcff38b3477f7a0295fe29d6681965a23314edf253426b1e31d228000c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize430B
MD519b1898c02275d3b88c62a562adb2440
SHA122a6a36aa821bb027cc6cfee8962776a92d3ee69
SHA2568a742f3d1a37d9275e4af7ddb51123df553ad2aec486e784ad0d31ec94a0dd9d
SHA5126faa5ae6561d43a3519d505b530103c9ada12a3bc4c4c4596dbd34c7fd7f77b9fb9463c99a7a6f7f659638a9118ad669c66cb2b5e8b74bd6a929192f486940b7
-
Filesize
362B
MD56af62dafdcaa24c2e77020e6e7109394
SHA1b5481df3c243de93160305070f1cc3d0d95c8224
SHA256dfca7c92deaefb521824bf32ae6598da71de05b010a8ef54e903b02c78f929e1
SHA5125916f4d1b8b4e6af5eceb9af9750720eae859403bb705362b4a7014443f6319fce2503c3cfaebcedc5fba4fbee2e79d39cb21a03ec2f399cbe996a3dee97e415
-
Filesize
601B
MD55a47f10b9b61bd22ab68837255621675
SHA1bf2f21f01973d09fa6033edd2107dc609bc47f90
SHA256e8d792c85a4a01b5313d87b60d0d8dd7fe0cc2a29f75a9a439f7b3bf57546279
SHA512b2a5502b4b114dc8bebcb61ad1d84c89913bef823389cc0d72f0ee3c87db651209551c050848eb2bedd58ec3ce0025a196139f838b6ce3e16f40fb3a476d27a2