Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
02/11/2023, 10:34
231102-mmgaksae71 102/11/2023, 10:34
231102-ml5xjsae7x 102/11/2023, 10:29
231102-mjqd3sae6v 105/07/2023, 08:42
230705-kl1xgsbc48 505/07/2023, 08:25
230705-kbnt6scg8t 105/07/2023, 08:22
230705-j9zhwscg7x 605/07/2023, 07:57
230705-jtdaqacg4x 304/07/2023, 14:49
230704-r67n4aff71 1Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
05/07/2023, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
Screenshot 2022-11-10 13.41.34.png
Resource
win10-20230703-en
Behavioral task
behavioral2
Sample
Screenshot 2022-11-10 13.41.34.png
Resource
win10v2004-20230703-en
General
-
Target
Screenshot 2022-11-10 13.41.34.png
-
Size
1KB
-
MD5
b38e48ea9655ce9b04556914b034b62c
-
SHA1
abb0088bc9faf5d44fef3bed79729da1cac04be6
-
SHA256
11b0eec98c8b9b8a41e0e77b1c660f3c582961d158a678a215c73c919f119f37
-
SHA512
e737ef9b36fd17e6c6c101624fc6c6c2ff330b5b3fa9fd371af919a6711cca1354cc096dc01170c1ef629524c03c8e00230cada17faf2a6a2e2f6c689f154f6c
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133330175223095165" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3760 chrome.exe 3760 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4920 chrome.exe 4920 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe Token: SeShutdownPrivilege 3760 chrome.exe Token: SeCreatePagefilePrivilege 3760 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 3760 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3760 wrote to memory of 4012 3760 chrome.exe 77 PID 3760 wrote to memory of 4012 3760 chrome.exe 77 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4612 3760 chrome.exe 81 PID 3760 wrote to memory of 4472 3760 chrome.exe 80 PID 3760 wrote to memory of 4472 3760 chrome.exe 80 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79 PID 3760 wrote to memory of 644 3760 chrome.exe 79
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2022-11-10 13.41.34.png"1⤵PID:4956
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9cdba9758,0x7ff9cdba9768,0x7ff9cdba97782⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2016 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:82⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1672 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:22⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:12⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4268 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:12⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4448 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:82⤵PID:820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4592 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:82⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:82⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1876,i,3878057168272622410,6838341802666877394,131072 /prefetch:82⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4248
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9cdba9758,0x7ff9cdba9768,0x7ff9cdba97782⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:82⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:12⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:22⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:12⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4580 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:82⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1768,i,2314463133060281829,2285538097666284020,131072 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD5d55213ba143d3b554b4239cea729074f
SHA10f69cb55b0c84bb318971c957513bc64851e0ba5
SHA256c4d1d6b6fe847f3a9c4a74927da87f89da6331116c56ab79e55e1581bcc3dc33
SHA512aab6d5c146e277f8fc6328d574695be65b811c7c61d6ee5e68bd9ff4657b19e575cf06a127843e7141784ea758fc8a94d7e784a7f571ffe438eaf8831a457384
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\501f0b00-8410-4deb-8c85-d3115acef6fa.dmp
Filesize877KB
MD529167300bb2e538a56c0a02022978d9b
SHA1447c0a8758ba7a5f75191c99a51adbb59409ecf3
SHA256deab808b4c3d97f8940b65318e043050d9e6d5360397f7aa18624048c098cbc8
SHA5128bdc712276bc6425de6d75dc01fa873a53726543cd0bfd621a297baee57a1f13b504292849930701d70f403f10a7d380252f4863ec148535cc07a7d52ec0389a
-
Filesize
40B
MD55f4717e49018602f429de4a1c764ac8d
SHA14ebf5362db47360524dc299152a86bd83d634cad
SHA25626cf70fc8289b4140e123e66222ed46a181618aff2b47b281d74c91b52fda7fc
SHA512014d4027d64cfc5a9ddda8f2d0d23040cfb7fbc4f74051cdafa8608b10483c79df5ecc5dfc092bd0b749f59fc3a01e62dafd838491ca1a99ce827b5dc22d1f82
-
Filesize
40B
MD55f4717e49018602f429de4a1c764ac8d
SHA14ebf5362db47360524dc299152a86bd83d634cad
SHA25626cf70fc8289b4140e123e66222ed46a181618aff2b47b281d74c91b52fda7fc
SHA512014d4027d64cfc5a9ddda8f2d0d23040cfb7fbc4f74051cdafa8608b10483c79df5ecc5dfc092bd0b749f59fc3a01e62dafd838491ca1a99ce827b5dc22d1f82
-
Filesize
44KB
MD500a61ac5333857d4b113282b30188471
SHA18ab0e87f698fe5690a06d82cd80c7fae26189658
SHA256d79a3042754614bf3cca3b3decd16218afb14547d6526716a2ec33266538e8b1
SHA512607e04a709b4383e8baccafb3b84c91fa4a6e5527548db6cd13920299c89a6728718cd4fc0c8aea42d1ebcc86ae8a171bab1750185b128b493dd7a5bb05e6ee4
-
Filesize
264KB
MD558ad31ab26d4330f7812803a943c2057
SHA1c58e75a3e44613575cbe55540323addf04258ca3
SHA25643e9fb13f1a49161bc571ed90c2af6ea3003ba97284804c509989b25eba30bc8
SHA51241edd4213d16d300e76489929a9e1eae801dc7d6986bb16507f6b74b928fc15135bc9bd75c12c8b48090fef21c2ce8c2504ce981afc5b857cfe3986eb44bbb39
-
Filesize
4.0MB
MD5a081f64a7b67f282df926bda5e7be565
SHA184d7970638a810a610ce4593995f8660e205b0f4
SHA2564c14144bcddf02ffc9fd2e727d0472052ef060cfbf910ea71a9d26c3944231ac
SHA51285a68548c7521e400694cde7db4f8739a4aaedba770b4f50b8acbfa7d8575b8ef2d178b79e02d92d6b0ec413f1b3a28cd042df68eaaee41572d3217e93bdbbb4
-
Filesize
37KB
MD5b0f2e2db4c2b7c702fe5291bd258a0ab
SHA14e8d5e04ab9cb6b1d77aca32365e9fc816b745f3
SHA2569d224d572fc9918d8713f2f1731a1dc1c312b36c17998a1ad021c7906489b755
SHA5127ffdc44d9645c09b09191fe57635c2788cf94ef5eb32d22b1850fcc1f328d261b71d96d2801c050c578a578a6ff293c6fd1c91df1d4b676989a78be7f1743daa
-
Filesize
53KB
MD57466910f622cefd2d8f9dc3987067733
SHA13afd364e034749293cb1403ef754429e485ac331
SHA256560483695ed326f8d73998faee2b42102da65732d4e19200883ed5a8d6fb996c
SHA5125fae9059234b13d9819a0ac44490ce2c3e6bf64e31fb0254beb5f8a5102bd576fb64875ac4fb5865844d193d3668e17d84db927a93c73e0f0b51b128faaf7c63
-
Filesize
317B
MD5dea71be0a48a95c5399c8a96471779c3
SHA10decaae780fcdc6f486447f6f56d24c2189c248f
SHA2564dbe93ae1c6d68db72bff73f8468a825b4842228f78bcaa62ee25d0eaf409e2a
SHA51265e93608bfa6757b18641681584e54327293f35cd8cb596e2e40fc854ef0710b77a245fd91a38f4829e499e240db80e9654eb24651438dd8f916cf2be7288dc6
-
Filesize
327B
MD5c9cf1ecc30800f11bdbdb158784693fd
SHA13188d7f8106186f14025639b1d835d61b96f7f63
SHA25661780537af9d98bb07037118c656e70bb1d7144f20cb889f342f9682ccb7a2db
SHA512a9051dbfd84ee6251ccf551d2ac602a92786e234db391574f3309f76d53c6532dd98911ecabb75999219921074e710c66abd3fea3b7e81743a5a2b2ec608d850
-
Filesize
329B
MD50d2b9ff8e583c3061cfe516047db5a22
SHA1292db8e6633164a4086e4f90df4972a5ce70e706
SHA25668ccc52c6493f32a8988475451b6f5c12e2404756e585d861325a83ead926baf
SHA512aeb8b09cb53cd6cf406f786aa7309ce6b0010edebdff818fdc7f369fa7c96311f2aee041e375ef67a2cd7973bb3b7a69ddbb6aae406ead01caf368150b92ed5a
-
Filesize
36KB
MD5ff33e4c7cac115032bc60176b3c270a0
SHA1e6af1b4f16e818e6622208ae331a0a282290bd53
SHA2566816507c0ded5e2c1e1412b0a08119d899eade369e847c5f5a076de17a307bc7
SHA51276f2385f680d66d21548a597a5c0f9fd5ec45bbae6793e32f67a131b744fdd862c10eb9abe00af7d69d0bf11d4403163f69d75a64d7d9767234de5023ca0e299
-
Filesize
4KB
MD5943e2fe624b184859f1f9a86e842b99f
SHA1ff6530185a80f1c64e336e8e64bb0ef0832627d1
SHA25675db1f7cfe1b0ee7caccafabb5daada60d5f4e7aa1797eb9a152339c24517bf6
SHA512c6890e15e94399707bb04d4a1691627f0c93e91cf0753ce27114edb2cf1ff6126aa3a7532b2d8bb14a7cb7ef5632d0eaa75acab68eeb3a08a1fbbbe20ac89942
-
Filesize
371B
MD5241043c483385d21e6c3a97e6f6b1f71
SHA1ab445d7cc5a9f953a056d301b17b8c4b74173388
SHA256dd1a1bc57efbde02e499fd3533fa26f64a29c56d55fba01ce29db7c12127a25a
SHA51260b6c431ad6553fce4c5b07a4fa83c16c7619fdd32a335258320076b8d36a6849614f4a2efd7601c2fcc43e6c38f87e4bb54a3dbbc683e7a043949946619c1c9
-
Filesize
371B
MD5e71b0aa5976b2a02741bd1751bf96e0d
SHA18c92ae229bbcb69ba5cd02393c6004a82a061e4c
SHA256c92d90345d2ee7d55bffce6d06891030ee91addff6a8b9f5bd29b25012492a02
SHA512955f5954a4af0bc0e6576c838eddf63acd337c3b3f9b38d4c156afcde9b23cb9de6434429efb1091e9f5149f215cad9813c46f96f80ad0a844a23fdbed32931a
-
Filesize
371B
MD5e71b0aa5976b2a02741bd1751bf96e0d
SHA18c92ae229bbcb69ba5cd02393c6004a82a061e4c
SHA256c92d90345d2ee7d55bffce6d06891030ee91addff6a8b9f5bd29b25012492a02
SHA512955f5954a4af0bc0e6576c838eddf63acd337c3b3f9b38d4c156afcde9b23cb9de6434429efb1091e9f5149f215cad9813c46f96f80ad0a844a23fdbed32931a
-
Filesize
5KB
MD592d4b5de739727f96a4089263109d8c8
SHA131f1ba2305bee3c8ac370f3714fed96ed61c52ac
SHA256d9d64357fad1de26b330a7451e4ab40abccaabef30649dd3ca9d299545b16c99
SHA512edb80d33fd47bf4e422fc099cb7bd7f21bda569bdd34295aa61271c0a33d6cda34e63a1132e0f55e8ef914f4d990b950d1f37d2750209d1c85527ef4c7557403
-
Filesize
5KB
MD599f096665a9dff7bae271c35c1de4aa6
SHA159769f2d692ab556728b75789ff5e62e5a32792b
SHA25616bb266339994920ff8e19864b8e0497d3684ee272d3dd8c3d5252f6d7a0a00b
SHA512d0aa69b883cc2c42bdd034923758486488a145a0ce3d3c0bbcdbafc8ca3ee57ad5fe63a803e1dff13a4bc2c1b20aa2e0052db419687a7ff34aba46ef1ca3c698
-
Filesize
5KB
MD599f096665a9dff7bae271c35c1de4aa6
SHA159769f2d692ab556728b75789ff5e62e5a32792b
SHA25616bb266339994920ff8e19864b8e0497d3684ee272d3dd8c3d5252f6d7a0a00b
SHA512d0aa69b883cc2c42bdd034923758486488a145a0ce3d3c0bbcdbafc8ca3ee57ad5fe63a803e1dff13a4bc2c1b20aa2e0052db419687a7ff34aba46ef1ca3c698
-
Filesize
2KB
MD56e9da3fd5e29c6b0b28f0cc7df50eb1b
SHA1563c61610ea635773a9bd963f30037d5d356e1e9
SHA256169a819f9834b4bc0cc09179ba83cd4a65225985dacba45bcc5c17c560701840
SHA512a46a4dce5a9581c27cac22e638f744986b1586d102d56ce054cbbe57a97b6d8cf832377d582af1de360b496bda38548611bd8c4a74f113d61130487fa03fc10f
-
Filesize
345B
MD583cb7ab25ee97cddbeb7dc077a8473d1
SHA137f790b94152ab74af5e3c773cdc50d23163ad28
SHA256caa2073e9317f08a3ae53ad3ffb71065923f513528b7db2040ff042285099229
SHA512f41f940c96fdaa0e1e35e052ca228ddf5737a39d03510c88f095bd6a90cc25542c5c2a1162eb7ea65ce5e48088733953314595ccbd2969eb17c146cc56d1ad9b
-
Filesize
8KB
MD59a73e862f5d454753f020820dd956c9a
SHA1bcc63e9c568dc8f2ea859f07777ded30f3cc106b
SHA2562172b03d176f1539860437da9ab392492665f1568aebfd4c31170eab9593b75b
SHA5124870a8d42513c03635faed9f9a292537820ec7834b278630a82435fa6ed8261cfdac872aac90004706f0a43c2046f509b68966cd17b00056e517297189753211
-
Filesize
321B
MD537d116bb6923332d1e0cf97c7a9da1c1
SHA1971f5f2c67725397b4cb1feda8b2cc18aaf9c03c
SHA2560e7e7d81d4790ce60aeff2c786a9d170f7f6ef22aed34023faa8521335feef32
SHA5123670442ddef2d56c3e99d41e2e8029bea39a51eea65691acd6a86af647b8a0bdeaf8d4f2acf111555be8bb8b794e05ceaef59ea6cb52fb168c212746fc8c37c4
-
Filesize
874B
MD5b90012b7a2ccaca310006dfbc8c39926
SHA1d7a5b166b4bcaf94bf3b3400f0ecd3b6a2018100
SHA25646ca17f47ec9cff67d600c6de0074e91dd0fd98558d3c386ea65de2bc81ffc70
SHA512910663ecfadff3cef42b310ea1497d53f754bc06141352250b06b41c0bbb9b27304b0cb8a1ffb11afe11bff079d4f89bce9d7ad33ed40661ea79aa4a13930f55
-
Filesize
320B
MD51d1c4caf311c4887344794c965042c96
SHA126826c349f30761ef50714daa52625c6f149c7c2
SHA2566ae0d21ccaae6976a705738416c2644f9053c53366f97132ae8ca64d610e39ab
SHA5128dbe45c72fb058df1fa2fa2c34d044fa6c9b51765081aa7f5fff4a8794b4026ce484d0bd103827a6f9ff539b5421340e222ca2b302127e054239fffdce134df4
-
Filesize
918B
MD568d7541361eaf2740c4be05f0e5af344
SHA1af6d1dd974ba47949f0ef041b72d739f1cf557f3
SHA256f0a709798a7de0ad698f73d25c97626b4b800786219fb461d53faf37daa152fa
SHA51213028b9d0d696d9e4db7781919b9eb478cede267cfae2d7ce8cd8ccecabbc44c54fd7e5d1362294be708c208798cdd51742dddfd02600fb7d2926147a5503bc8
-
Filesize
338B
MD51acac2560eeaaf08bb17124aeae2d255
SHA154a7ad4fa181a1f6a1f8a0e5f872f1ce327369cf
SHA2568a51632b0ed9fa219f6b537a543140c83ae56adf52666f13dc6d26d7ac2a4ebd
SHA5125546f47fc5848adfc462fd12fd508829c2c113aaac3fc0d3e2c0dc30290b42cea0b06b089d19f408c8176d666f53c4194e3668749725b722e52814f2dcf8c0d0
-
Filesize
14B
MD59eae63c7a967fc314dd311d9f46a45b7
SHA1caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA2564288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8
-
Filesize
171KB
MD5eb345db2c7ab57dfca07ee957451f323
SHA17e17f0a69c2c4c0f95814d07d6e6dffea9fd8d77
SHA2569572ea475c59cc8a3239584120584034df9a865b21c3514d5acdbd3b83b91ac3
SHA512dd51e1eb7245d871a59a294c85051fbfdbe4394acfe22ecb6feef5561a1a63f2a57358ad1a4b8a9cd06bb41358720939fde06ca9b94e015ed53cfc0310ba070c
-
Filesize
171KB
MD5eb345db2c7ab57dfca07ee957451f323
SHA17e17f0a69c2c4c0f95814d07d6e6dffea9fd8d77
SHA2569572ea475c59cc8a3239584120584034df9a865b21c3514d5acdbd3b83b91ac3
SHA512dd51e1eb7245d871a59a294c85051fbfdbe4394acfe22ecb6feef5561a1a63f2a57358ad1a4b8a9cd06bb41358720939fde06ca9b94e015ed53cfc0310ba070c
-
Filesize
87KB
MD56deca6dfcc7c2eddceeeff9fd864a90a
SHA149a16b4718679064062d6a8cc0263f54b95b5c0b
SHA256c039291cdc8f649f0bb2556934085c046e9c6ac9007c2b6b9580f72378b87676
SHA5128f27be26d156985c398ea77ea03f3796c65a88c6adc5b948ab12afd50ce6af60d3d2d82f2664d8780f573cc55cb5f37f997ab2219855db10a220e464c0f0c4cf
-
Filesize
93KB
MD52d174b8d505167e606bb4eeba9709361
SHA1274f27c38e2924658bdf471e95e48e90a648b332
SHA256c349fe0b83400b3be5f7e10c801b6df3bcbfd4e6a42523e657b38ff56431e1b2
SHA51270461936406361c5b6de98d298398ab974dc8601d45fa286a05697fff23f754c95a5f4d341f21d0ecfd02929709a7eb57d0273287d0db6350ee497498ae58416
-
Filesize
95KB
MD5778dd6c13b8e93df1b478907e8025a94
SHA1efffb00ed91853c0d56c8e300ab6572659b0c2e9
SHA256fbdf8674f43bd0861c8763f81ad37ad16ee97086624b98fd8b03752e40f39a34
SHA512b20da2b0e332e56620ad9399e7cb75318d04266b03dd8623f9f55f982164ddb4a4f1a5ee358fcf07ca3ea98fc50b8560b8a0811db1ad92d8c328f61798b5fb33
-
Filesize
86B
MD5f732dbed9289177d15e236d0f8f2ddd3
SHA153f822af51b014bc3d4b575865d9c3ef0e4debde
SHA2562741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd