Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
270s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09/03/2023, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
📧™ ETF Invoice 09 March, 2023-575260 PM-87262.html
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
📧™ ETF Invoice 09 March, 2023-575260 PM-87262.html
Resource
win10v2004-20230221-en
General
-
Target
📧™ ETF Invoice 09 March, 2023-575260 PM-87262.html
-
Size
113KB
-
MD5
2357424de84686980594881fd9b9b6ea
-
SHA1
bba5f7e173149a957be61ecaef46e8191519c984
-
SHA256
3a90eaad2bc909eb3ffaa926f337eacadde1a2924f7f485f5fa85e4a0b4e24d7
-
SHA512
163e7290b9a457d389c2fcfc7859c34167370dfc13653155788fb01249721b96cd2f8a1a18ff981ee72eaebcb7961f8c22f2bdf3753120a7d5d67be7fb4fb9f5
-
SSDEEP
192:rarn5yCr4p1Qvt4oMx/lK14Hxx0lrlCL1+3mKLbU2S4oMx/lK14Hxx0lrlCL1+3H:C5yCkpQ2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EFC8A51-BE85-11ED-9E96-CEF47884BE6D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc000000000200000000001066000000010000200000004513bf1e41c943eddc75e5a3fc76ec965f3d9f7c9007eb2e387240618ca3a820000000000e80000000020000200000001a5ddb3646814c0c6ba98d293c6696d1620dc90e05da3295049ad2e65173f95690000000937186c0b8e715b7a09eb55834c831fbe73a9045c66497dd801db71ec44248485910b9e0699cf995db1443271b811ba8eefaecb1f9a090f409cdac267810e1fb715c173ef1d34ad633a7080b685d007018b1cf4800c0bdb74b69ffc8d675389e0dbdac6abd8057c8fae9914b44a2664a95d47278d4f3f1a87feac55527a368caf50847a36ccc899deff7cd07c6b2648640000000bfab0d1ba9cf574e62ef94f9ea9c248007589425ea7625ef2e9e35d935479d8937eb872bd39b326bd04bc232e62073eb68aad98f65d3bc201c466efea0ecdd8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc000000000200000000001066000000010000200000007f819cd42511d74b41973468641bb58608485dc9f13f62e28ad56c617824e750000000000e80000000020000200000002cf5a7038267bafc05eab6ad58482e543a93788c7b8027df35df0cd90758374a20000000aac18510822e359f60eb23c322eb5c41c5645d205d69ef99048b3fb4ce7d1f6b40000000c87a68f6854d44c9b4ce5b75e1aa449dacf4d3393f1ba0909f1a267474cb072acf55e58d319cca26dd4c3e6902efada62938b8d97da4f4d55a639a62109be45d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80afc4379252d901 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1616 chrome.exe 1616 chrome.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe Token: SeShutdownPrivilege 1616 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1408 iexplore.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe 1616 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1408 iexplore.exe 1408 iexplore.exe 332 IEXPLORE.EXE 332 IEXPLORE.EXE 332 IEXPLORE.EXE 332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 332 1408 iexplore.exe 29 PID 1408 wrote to memory of 332 1408 iexplore.exe 29 PID 1408 wrote to memory of 332 1408 iexplore.exe 29 PID 1408 wrote to memory of 332 1408 iexplore.exe 29 PID 1616 wrote to memory of 1928 1616 chrome.exe 32 PID 1616 wrote to memory of 1928 1616 chrome.exe 32 PID 1616 wrote to memory of 1928 1616 chrome.exe 32 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 984 1616 chrome.exe 34 PID 1616 wrote to memory of 1036 1616 chrome.exe 35 PID 1616 wrote to memory of 1036 1616 chrome.exe 35 PID 1616 wrote to memory of 1036 1616 chrome.exe 35 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36 PID 1616 wrote to memory of 544 1616 chrome.exe 36
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\📧™ ETF Invoice 09 March, 2023-575260 PM-87262.html"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1408 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f09758,0x7fef6f09768,0x7fef6f097782⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:22⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:82⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:82⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:12⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2236 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:12⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1152 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:22⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3476 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:12⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3784 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:82⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3740 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3924 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1128 --field-trial-handle=1320,i,2942981017276672782,2271993941713115076,131072 /prefetch:82⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2196
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD57c6ae82f0661b107fe0029886a8e9506
SHA120cfdd24e33b49c6bec67a52a8076415ec80fe37
SHA2563853cc02851d35516bd479b587a069d5a9eb60a9a9212d7d85d3b5c7f9c6c0c4
SHA5121a724a00a6fe261240bf6269774b254659843068dd08fc7b3e5c13697c4dc2e164701dd7988fdfe762a2da0ad00cad456ca9bcfee2204bf1df76d5f93a59240c
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5fafb2d795af06b05e5ae489401edb786
SHA1137f724049c8ce7dc1d438677f7b6fa32b275205
SHA2567673bf3d6aa2a14da9c3433ac1651d907697a7c79e32987d150a757f3866b5f0
SHA51238c83466ce78cb43dbfa8255432abc7b6347589b0a6dd3b00aa4d81dbd9664a3cafc2bbca9ed38bcfa0ee32ace2a8ea8c8cd5471d6896f7c4dfd6dca03089769
-
Filesize
471B
MD58e5838c79dfdfe9d434a7a49ba7b262c
SHA13c88828e250f2783970af534cfeec4175f08a215
SHA25619a3f73ea0dc1d03c178daa31c6295a2b0291824fec3e7cbf28f8299a7ff04b3
SHA5120d58414cef5d8e3132c6734c964054b5b40a672c18deefd881be5adfdd01722ff3d94f35f2cb6ef2b4f5501b448ff965c263a84bb28c4a3eeb932ba20a269756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize488B
MD5c08b5e9bda8f1518645d9579228e9ae5
SHA1845678460cc004b80cbcbe8b325b10f7730ee0e5
SHA256246912bf63c8cd25962f32e22ddd09d0ffeb0450d7147221f82e18264f3b8ad2
SHA512c69e2141a71d6805c1574146c96f158e8af8395c4a928f1042070bcf072f228d588cf82920115b4799d2fc26cf47e37296fd170e7f8afe9166763fd31821d4e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b47c20e7b223bb7928b0166ccb3ac74
SHA1b622b85631d7e9d28b230c6e98271bdcd6290c0a
SHA2568dc62554c21410c56c02b7c1108aa1dc2828d5243e7bc0e47130ce2c5acb45e6
SHA512dfbbf06c572f6c8961c7b65ab7a841e0e9c174b8085bfd4eeb7d2824f1450b54b834ab21a4b376b331cf7c1b9443c269ffea622c21ab2b08a3da6825f52fed0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ae4f5b029d4c667e1e3d84615450c47
SHA1c40c0a17f7f1db61390e65fcaacddfd5e2d035ee
SHA256c2afc5c59736b38aeb4a608b8568b40c9d3232c5cec0c6a41280e40054da1ef5
SHA512ea3d6e5a5f81d4caadb94301496913ae154dc6953372e6baa1d9ac4e2c6d68e6a2e0bf309223a178d0cfe399b4e6e8642355a5765ee618abfb98ed90fae06fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9b3e6e945288396bdc2de472d79b87b
SHA18980327605128cc817c74bd5164d02b9ebe02e96
SHA256a8c23cc3ffb4637bece989683765f8b5cb09adb84fdcfa3875c211ab6b9e95d2
SHA512e2114117f2a28f4be14967c0498578fdbe648349e62d70765b30ef3a80bf2b63b84053909967979b89a4965c6ccd9492296d4ccdfc697bedab1aba5c79d7676d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d8ede8b992111fe4684208953ff4336
SHA1d6710be6726f1cadc7c700f9c4490667109f9ce0
SHA25633542f75ecbf1bd8c228a5e7a6e99fbf271f7056632d472d2a0f063fe494aa34
SHA51278fb115717b39508713c56078d098d5abe6b53c1ea61209031577e7bdfa096c474399aece2436903807f4185c6c6aa1384fedc8002f648dc79570f2c5a094bb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531f8b1e9ad248389996a1b7b9a6bcb97
SHA19de09470e9c7d445e0b41e0a61d0b525d41433c0
SHA2565a51ff1ba7851075e294ba60152176bc7b87cd4c9884eac66e8e9f57a416cf7c
SHA51217f6219ba9692fd665928d303fa8056383190c4e923a2a602954dc09e5d78f24da2bdc2762372e54936decfcc693c57b290aa3de0bcc0f8c89fbb11bbb13564c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5429bff164239375531ef21b26ec7fb0c
SHA11b773a03dafd3a1cd3428dc492065a267ba2c305
SHA256a992636a419595ee3e0984de8e49f4a804e735860a8552dae330dfefa3a7c744
SHA51228afcc88bee4500ea09d975df4d12534a1124e4eb984b6f6afce027badb98228b5dc27baff5a3af7f9971767928509f33f10e51052aa96c4e39281fdb74a5131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575049631f49a025659d7d5772a44a086
SHA1137a91b345842e47536991b04933994d3454dc65
SHA256028630523e3615ba2489268858378b558bbd46aea3deeaac0bad36c53972a15c
SHA5121fa2f76fd73cfdad01e8d8cd62e5d0cb82376efb6e1f015cadeeae3cbe61bd7cee4ab9adaa68097c5b405850845211aafb3d537b0ff38cd75fa5c9f3359dc2ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508f20c323fad53145414d7e338d0afa7
SHA1b570f43a895158f8498a88004c1b59b728a1befe
SHA2561d8afcb8629b245bb7ad4506cdbf5e65e440f1803fca16d2484e27080636780c
SHA51202e31d3145dc95e847953c79f58e019115f408404522832b0290f6d8b02f558ca75b3f4bb6c3863aa5aebb21fb57dd4ae41476feba67e9f7448323dd15641fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db4b5f1d01f4d08830a3f70138398cfe
SHA158024de358addd650df29d8d6f47f4e76ba7f949
SHA256416a9d6637c8755237dc621349f6bc7e6057bfde7ded56b6b9fe4c355872e6cf
SHA51204002c356902608b4b2ef076dc0c9b6008d3a065e8c4fa5756bb9e3863980ebccf52b07e1a6fa0e25a969746885882438848d73f1ddf306abcf3597a6e4790b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f7f48a37f88ab59b09c5ff2bf132732
SHA1f6aa2646e0783356b2162f198778020b39dc9409
SHA256beafe1ea26ff847f71ca9ebcb5026e46838056f143d91fe23ca35a8df484b142
SHA5129c2c15cd7c77b1aa31212b311729cd6687a783fa3066341b63b8f724c0403a85c10ad32e067f52145286ea45c5dececca899e987a214fa855fe6a97213e62d60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b3e1717cb9d65d739693dc0c161af89
SHA12f45c7e37be8ea57718f94418e78b6cb0a50d709
SHA256c4dc4dec35f222ab31248b5412cbfc161b9479f4c9c574f85a7ae746870f25e2
SHA512cd5025bb6071290c79d34952939bb28ef377ae19a0de969337ef95c142f1b733cdcf1f27434d6f133af0f85d6b95c154b7a244591c98a5484650fbcce1958688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d1bfc7e1ddd51f331877955ff351b97
SHA1ed88f14144697188b0d293fb4e1b1fc7ca3ba87d
SHA25671c6d8e75e493239d88679cc6caa2e48ad7b978b5bbb9aa22ce327245d91e1cb
SHA5123197be38d2aa0d5f2e90ba6aa72a79509e97b90a8c28b99d3554d0250efa139ce6405e254a3bf4318b6b908dfe8e608410951966ef90dafc0403898ccf700586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53623b18de2ae406e2a4d1c09cdb229ef
SHA12ff1c625cbda65b6ad909057bca092c1d8348518
SHA256919bbbce3d28fb22b2111141cd1779d0af9811f4254ceb3c4f89440d7739cb50
SHA512d563992e0568f90b5e48a16489527e809978b498688b9d2f54fbae192c00144b5a7d55cf10c1bb4a0194cbbd6126ef3aafda2d6a82cb6c0ed276c2c657ae01bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d5b867e28510c5f3cf22555063f5b68
SHA12918992597a40ee14fec0bfa1cd50e20aecd10b3
SHA256e5dd51f00c6449f92a827482e70bd516ff8d065940b3ea5cb2ada8716cfdebd1
SHA512055bf6a48e63a2cc3d89d5bb0590776461845347b3b28bd76168f68095d28ff2f1854b40bf1ee04428d90a1064c65111db75659a720693fd505a137533126292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5fe4ce443848320d486a73cfb1dc4db67
SHA113262b38e90d9f9fd2c88c83d9e62343d2ec97dc
SHA25647d546ff69c89792a8e27cbc5b9837347ee18d3bc94c1abbbec9dea47e7b3b00
SHA512a63e4dc7f70476bc4d498837028cab4d0d88b9a1d096d3f6b645875c5bd1949aff0b736d3a0b98fd42ef622a7c6c0614f0df8513ebc9171f5faa2fdbde3d3c81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D4B7A9525B9EB63F11D82C4D65AC615A
Filesize484B
MD5c5dbff0fdc3888bd6620737cb2e7faf5
SHA1818ee8e8afc449e6282119303450d52b7dc932e7
SHA256ae5628a794ac97f1b32b1dedb6e9fe153e069de8da02756e718b3475261a7e34
SHA5123a9d996ba6febc5ac93dda98b18071eb6a905ee670635ac66aa3ad2504a1e9831167d1f99a77a3c06073c3022d905867e00e6e65b5ba84a44bcb3bff19f13ee6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\35fd2576-5c91-47ee-9d03-71e2c8db609e.tmp
Filesize4KB
MD5b25c5a4739953dee9fa661864beab691
SHA16ff8568363dccc5c9726bf4b0deee1be49273abc
SHA256264fdbe0bb318846f9efec70394a7dc93a442d7f85ae60707eeca568bbf05e6a
SHA512515dc7c50ec08389ace0f8057f8607eba12f15b09ecac53eda0c7af50999fb3aca189a846129f34b4d1b9d5a6b58f5b9c08cd4464858d78b7b5d8584362db25b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6f2e13.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2KB
MD57ddba199769a847e40e4d4c536f07b8a
SHA179544b1f7e788d74d6168695a7e64fa42cdb94c2
SHA2567f1ec14a982003f18241c3ff4388391cfdb5bb14894892f4acfc31095e998238
SHA512271dd499e685eb2b193705152a3fd662cf9165a5b0c7b3bb664b9829ab859312775b682013f857ca3386c5e462cbf55a6f1c43c2ce5449950901d2be48b9e430
-
Filesize
683B
MD5a31874da162528faf3818ade0b8242b5
SHA1c047662f70862166c9bfab5dac3407daf8c2c1e5
SHA2564df92b39edc6ece0022fd329e492ddf9cc90277b148d1a02d5d10cd9b5d74394
SHA5128d7ef79163e3d8830c86894775d9f5dad788a44e76d8ab9ea5acf00772c557dec84a72e88eda3f17a88097a1602a261263bc913b832fecdb630cf5836d1cd714
-
Filesize
4KB
MD5e75bdb724b6d6d832fba568ded325612
SHA19c457bc1948d1e0a3e6d1cfeb7c9cf210479c3b4
SHA256ff8f8ccd717bd4f88c0ff3bad4ba3284a9660ca21e208a2669837dc8982f93ac
SHA512955d479b0cb188a950609bab60c18db7d262eb4f11f816f8d859e0bf4c493df94c96e98345afc20bd3dae7c1bd81e23653fcecf03d27e61c41e7f4a2469ed646
-
Filesize
4KB
MD5bd77adea0f205edc4ba46e5cc5630636
SHA1e70370a3b058755b1cd086ae1f00d5906543d43e
SHA256bd5976082b288b14ee5df52bd260fa4a0995ad67b665ba6f0907b0fd6e428b63
SHA51294f35a7ead658d638d1d4f90fc896cc2ca384c9d3e8b551778d9ca3b222259fa354a329062d159268e901c41aec1550137253fcbc80b4c70edc6e520c95a5ce0
-
Filesize
4KB
MD5083aa49e16ec20187f01acb616a4c25d
SHA1248a86621302978a37f7720d9ec25e8c08b0ee38
SHA256d4b921047e51e5d73cfd8cc1086e802b0ab10afcf1e1f0926f7558a0c08c2ded
SHA51248f7532d3df0e9d31d1df8213d0f41d2b247bb767871d5a8f2383bf05cd7ef88514fbebb88469d48a00c68ef8292226a9e7118cab53946dabe790c7b7a92cab5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
600B
MD5c62818c5214a01649fda324607a312a9
SHA1fe070ebd3b6c4174b6a95c5272fd5c080f72c575
SHA256de20ff46f93d08844cb527805820cc03da77ef19156705841f5889555a6763f6
SHA512939746b04cbc10754520b7637da861e30fdf87ef863f5b75cbd7c544364437a5447297f98d1063749b52086e89c9a0ca706adbf34e9ec5531499c0b64e7fe4c1