Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/07/2023, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher 3.1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
SKlauncher 3.1.exe
Resource
win10v2004-20230703-en
General
-
Target
SKlauncher 3.1.exe
-
Size
1.1MB
-
MD5
021b53abfc25a261077282498e5726a0
-
SHA1
ba7f38a28444504e6e8e1f995cc40ceb70ff6409
-
SHA256
c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620
-
SHA512
484bb65ecb1ccd3e5472a27737fd2fa4471240aeefcf4bfdeaf4e49636cec9b3e43a5c2feb7134074c92af01f52a456b8074aca8269480e210cfa3b51acae81d
-
SSDEEP
24576:7h1tjL2uma7hLQKaikK21SHCJ3ny+SGiPsGSa7tLC+/e0cUEcnr:sghMKai1viny6iPH5hF/e0m2r
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2886A71-2907-11EE-86C4-6E9AB37CAD16} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "115000" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe Token: SeShutdownPrivilege 2264 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2608 iexplore.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe 2264 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2608 iexplore.exe 2608 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 2608 844 SKlauncher 3.1.exe 28 PID 844 wrote to memory of 2608 844 SKlauncher 3.1.exe 28 PID 844 wrote to memory of 2608 844 SKlauncher 3.1.exe 28 PID 844 wrote to memory of 2608 844 SKlauncher 3.1.exe 28 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2608 wrote to memory of 2588 2608 iexplore.exe 30 PID 2264 wrote to memory of 2748 2264 chrome.exe 33 PID 2264 wrote to memory of 2748 2264 chrome.exe 33 PID 2264 wrote to memory of 2748 2264 chrome.exe 33 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 1220 2264 chrome.exe 35 PID 2264 wrote to memory of 2172 2264 chrome.exe 37 PID 2264 wrote to memory of 2172 2264 chrome.exe 37 PID 2264 wrote to memory of 2172 2264 chrome.exe 37 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36 PID 2264 wrote to memory of 1960 2264 chrome.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6779758,0x7fef6779768,0x7fef67797782⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:22⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:12⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:22⤵PID:592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:12⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3620 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3508 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2812
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f807688,0x13f807698,0x13f8076a83⤵PID:2240
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3840 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:12⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3500 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:12⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2420 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4028 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 --field-trial-handle=1232,i,8953019411498332523,2900393547627553660,131072 /prefetch:82⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5be14e3fa8554c6acdf3910a0862e3261
SHA1728d7bd6f2b7419bf26e3c87248499fa342aad4c
SHA2569de7c3aff020a7a9bfd5fc0af397f1611d80d7a44883a1d17a8d383895cc8fb4
SHA512199b6103d414df140277c755d07df246ffee9936e12e4d009149b97a1f2b7512d29928e7a9c52e0153bbdaa29a25bdd736f1764f64524db88045fa4358aebdfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5aa62f8ce77e072c8160c71b5df3099b0
SHA106b8c07db93694a3fe73a4276283fabb0e20ac38
SHA2563eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176
SHA51271724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5c11bddf90fc132ada4a523a7ce09c36c
SHA1d801d8062c0c76420e36eee78e60461eccdd9eaf
SHA25687594f9f741db26ca3cd94bab2485d90f731afa49f4c4f78aa7afcebf866b419
SHA512964f3702a430e3c198d42e290fd21e74a13a7b351f96dec3dbfb5e9cbe94ae828021d37c6b51790d53a9caf8df2f99f812a8179a2feb10e7a2e4ed36656ccfc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563ab1804a4a3f757cea11d210d5e2607
SHA135148379f415a40e5ad5e24cb9dd4eb8eef0ed55
SHA25688f735b60cfbe83356605aa4cfd624dfd2ac9bf3dfa795625fbc02102cb579f0
SHA51288016d61184a9584f499e705c5c57c01e398531633f5aa0cababc2589a49ff610b8d0279647283cee3e2e3083bf34c84b918f78341d143074a5d05984daa4d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a066657fd1d5a82987344f7a2c5423ba
SHA1fe9d88d587d384436fbeb4f1feb37ffbccbd8fad
SHA25698f636507411391768062563f4e5190a22f2362c0be827130816a428d32996b0
SHA512a6c05c371b6789f1e72769b8a80c3bf303fdedc181d66688bb296032cc07d0b4d04a0a051d28d63185dbdd104d3d9349089d6757116ce9cc2ce66f6734debeed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529bf6d492199422233ebf404a012356b
SHA18dce2d631abdc5c416811b8d11b66f4f39aa85de
SHA256f266c5aec7581fe21fe94790945177c34f6a95098ad7f201810a14e8052014eb
SHA512c8193da098ede7a2fd117898faa08129b1860276ad115879ba19d6dc52906650ad88ff3a3490dcf9f2674b5f92987f011eca0152ea19a37efc39f46275f8ae6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5526fdfff1c240cbb5e0cb0840c4c7f3c
SHA1f34089d95959672b5b72a7cb078b367891fdbd55
SHA256c48bc795f2b37773428ed826aa57b1f8d1756feb2b5b9835adb90ee0030f49d8
SHA5125e1945d49fb8685677dd1b9d81637b3070318335dd25dd7df30108d3a9c2aae42d400f2961f8959f42b86e338fa27590d515ce80cbdfe2767dc1aea3ab0bb793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d60cdeddefb46f0a3ab7761887ed82d2
SHA10b7e883fc1f5266f6bffe120a33b62d8dfb16b4f
SHA2562e62964a643ba8dd8ed505859e5a20d5b8f3469b41d26420364ebff9a5a9899b
SHA51255940e3c7be722343bf021cc0813608033dcbe742297136d0ef689cde49366a4db55af000d67cf7cab4c9342a18de6263aec65e822163ebd23d25efb1a4e887e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f6b61a0da81d0cd195ea415079eba19
SHA1df2f501269fb095b5a0c2cdd2c05e92cd16bcf8c
SHA2560a610b03f859c6ddb99c75d4565b92663e94187abf7edfe5c50190fe274d0ecb
SHA51274f0e6418ad2622e4269b6ee4beb4dce76589abad6deafef7a3374fb5c95e53ecf4c82a8c9782432979e368515468337834354474b6648d3f600ad88de675925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505373d3920868a34f99534be071672a2
SHA17c8b9724187e4d2f19a83016afc96b4312f0d2cf
SHA25665efe6590799620cf6c8a2f67d29cadd32dc3384c0a717de2ac7820d8e998da1
SHA51270bcbc404abdb9d00dc2051e5975eb411bea87a1febc764031b19cc625ed13ce7a25f62418a7e7ff9102ed7824d44f776b322658047e558b240e9a18569f5cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f54f0e693a26fb32823b0aa12fa5245c
SHA1a308fbdeda8213dcfd81478c4ee802454c9bea08
SHA2568e93e4c96bba9f1191ce41ffc3b21a48489242f5bf27d0d4fe88ffc3a728d2d5
SHA512d0673c0de350b8a70495fcbcdc50386240377d2194e0f55e1ea4f752eb20242e0de3fdf4799180bd5f4e5c7136728dc7458977977cb527cf83e6cb4cc13cd731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ec1d3ae449882c5060210ab44d62f1c
SHA18ed165ff3abe6b310beb9fd0c0e6c05154e0843a
SHA2563294866cf26fa37561fcdfcdfa5f5553c26d482a047f188d25973a0c4d6cef58
SHA5127fcacf85ed1c8d9fa72282fa39c3f804653ad0e70d4166ad8b6a3736475a4485db0fea5a1d5cd52bc324c968ba7e4d63b90c1e6675e6a4ba50e4c077fe79f177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52335cccb305253cbd414a6de1bb7f443
SHA1a5f129dfb0c6f3c196f69e1ea333a35d80839e04
SHA25656f990757d34a940737fa751b2e30ce1634843e44eade1b55dd47487f8c9579e
SHA512783508d868c9c7d92b0f0e41d5206c0edb2e5b509c301772589fb39fd67e9354b76c254a38261ebed7114f395b6888c14bdb4f3553b67fa82b8d1992198cf1c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59daecdcf9463c5be977c4cac1524ece7
SHA1e36aa72df4e6b01a6952add320b5b04c7d893197
SHA2565ca95c1596552d756c2ef593c5c6da598b7ac44efae0963fdc7022b84570b779
SHA51274c3b301dce802a83a7826d6b4b488a254957ad76c5567823c3ca7d694cb2dde1b8ac1c10678c5eb1bfce521ea215a82f597474e86d9948982479f35c6019849
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd63ad0c205daa789684790d82a51bd
SHA141a63ae7315ed4554d960e81ae312ea16b2126cb
SHA256bb221c9b6db987c1fedda09ac212c1d822c9ee51412959f905a6ecad92dd6a3d
SHA512f6727e01729600da180a1b6947dd2c62cce6f51261912d9a21c455c52c52ff23d8b883f1022c3ee37dbe9be45e9fd43df74bb5ae1752060a074adc9201f2b1e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fed25842807aa182996bb6c41be341dc
SHA13886eac79dfa020f0234a17fe870d3bd36f10832
SHA2561aef2cfc292f7bf67cc72f3eb6eecc79b1ad663ad9c85c3908d25fc5d49f1fa4
SHA512e162ce5883b646c6dd7ddc01098b9524911eb221bdbfcb450ed395d2774207be9fb3edc8e78b4d916a1fad172606d6f0a536ce40729161d5bb00a7a9aba3682f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543c8aa912fe9d3284c5dfb212dc39871
SHA18c6434a23a7c56c9c4c5eadf7e2165220d3a599e
SHA256624f8b1e5cb04d2e69faf5b04beecd5ba88037cae0d50ecffc21655d5a7fa6f4
SHA5129fa4f1304a71e1ebff9870c2df867ddcbadb111adf6ced5cc998398a6a51a44386ee07e0ea5efb0f79417d6be18a703ec5a11c0726301e948a52ade0f04f941e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5c8673e7bdd5ee3d0218a38ab090671b5
SHA10c7275dda286befe5f603c6bbf1a4efc92f994a5
SHA256e757f56ade45e7a95f05461a48d5731237102eddd8c443f1c4aa53eecf208e47
SHA5123c4ac3f660e55fa359a303520bd68d0f9e21065ea85da6b0daf58e6a73c327927f89465c26a09835601cc81c2a570edc45e642e14ab872731638cc75003daf08
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0502b40b-b80f-4d37-863c-a1bc874966f6.tmp
Filesize5KB
MD53d297a6882922d4a59f685f4dfa8f62e
SHA1bd900bfedd945b01e4d546876cb5467fa9d98cb0
SHA256e0c3344f96dbe0b7e7ed6712a61a145e932f60b5bc62e7e3f4c1c0a047d4d90f
SHA5128eb3e135790be49f43a9270c96722001ca45134eadd9ba32577e270fe649aa90861bd04a745e8b94d1fbfa0a1f0870062c75a07458f3c698f8af19272a56ef60
-
Filesize
34KB
MD59735d3ba060775a19808f49f1b39efd2
SHA1569eaedde582d44dc250e051bc75751f3daecc07
SHA2564a2fc86d50b0cfe3c34635117be0f34376c77faac2ee29918a84f8f2ba9ddeef
SHA512eb8a39270086df8567c304def71a01c086b536fc72714db8b1d1c4a57a1d70abec5c7daecff7b6d0cf816f2d0095268279e58361175acfc8033327bd12c39f98
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf773092.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
691B
MD518a456ce1f84d00ca7e1e278ba88791d
SHA11d8b86ab691db638668344644668fb66d791e97e
SHA2568d330515fdcdf96bafda29e7d649f43b3b5d8dab55ba68e4204f2a53fb8b56e9
SHA5126f845dd166fccdb5591afab68e8b2de50d8c42207a9b53593df39510362bb9eb0861345e050258a483519a40fbf9806167d85fd76e1ae4cdf54c1346d3de8f0c
-
Filesize
523B
MD55b6b131449c239c8184d008a0edc4aa6
SHA140ab9daaabaeabc8ecf41327e8a09d24ca5aadfb
SHA256e7e52460c3fd8880d35dd67db785748e0b449de4bcf74dff9079d8f88cca82c4
SHA512bea4ed177212b5d3ee6a354716b5143a38d7acd96e5901d9b3dacf79c484f64923b2d9cb956c56e8b6fc065eb7dba415a12b03761c66eb8aa57964d43aa9f2e4
-
Filesize
4KB
MD56ca84908c5be0fa6b92a87bca698011a
SHA1c7638674f5c2b8a352a3c0a741051c2b4bf6b1ce
SHA256b8541b61826c0245684f2c2c3aa72974da21e923af77582c53bc58612b161b9e
SHA5129582534a474a73d211ebab52b8553e594bdac1cb809af4d814e88fac98d1c6f6d02d0519ce0a098c80ad1319a89f12e614ab86d6d824fb950f4d10a82e4431d6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize185B
MD5709237f48981cf1e8940f88e90ef0b5e
SHA14f3c50fb77828b1f640ec6950fd5cea56a1dfb9b
SHA25609047e7c7c6de57731e6aac4a7649e09fbb62659838835ccf9f631a37a52973a
SHA512b1e028790ecb9bfdec514223f75c51c6d3da6f72f0ce166c5cbd42e9fc67d7e7dbd3840afade09763e96692696f6927cd5e53bdd907f3e80df4a3a5a81a5465d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize112B
MD5ad61bd6b1f725a285835acadd5b48a3b
SHA1b33b6ebd9533718c8b11b9f50006d2b403910f41
SHA256b4a135e84af95619e63c4f5e76eb9048fbde4ac1eed20c31a2f81e39a9fceed3
SHA512b88a853ad4c51b10b248d6e1bc0902b1ea04ae14372ff2558f795fd5a3d533c1187ed3423358fb9dfb397a3d7d013cbcda1ab91137ee8fb0da4a2c1b7bd5a62f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize176B
MD58b0fa73a1153288637b8a6b5c9a94922
SHA1c215cfb1d5f323daf3a27df484933af47cdeee8e
SHA25620cf342fcca6f23c0f0fbc89f1741326d0f8e2befc244ab5318d74b752c67002
SHA512e811d683d1b61bc4684b381f4ae9b088686f77a06d278bfe621c2e27f2b5dc07fc9f0ae5c0576162ab4c51d48d9034f7ca1e3dbaf0064d86f78ece13607ad399
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
7KB
MD5cdc1dec5627572461e0cb3be9c1f9c9e
SHA1ecd750b620dc08b4da2337975a243145b5fc7c25
SHA256a3d2cf2d123929612ec7b9ecf41c9c34da5d795cd5d680bcebee1faad7d5e694
SHA5121e0b8efedeb80866401b77dfb62c727977d868f150885d52b1bc96e1fad42c481e88d75249e213be0e819888b625ebfc96e15d33d9d5371f2fb65fbefe769da6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1H774PEZ\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9EM1SEHQ\favicon-32x32[1].png
Filesize2KB
MD5df4253088bb850c76f81c91db284d4f7
SHA146e3e3c42a159f22038d86bf39fbde118c91dcbf
SHA256590d33ce64b321c321644bc8c840c354257371f8c247f776b788a5ce2c9bbc72
SHA5127804f8507d35adc2a3f65a4fb017bc50219fd2ee326693dfc5011cc9e22df61f50533ee7eb597133ac69e502683b7089df89735f03e11807a4724564061b0b22
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
606B
MD58f540693fb70bc459aa55d6dbe4eaf17
SHA1d7802926560541d2cfb0f4289885fb33fc3038e2
SHA2563b93059387c5b119769c26558c19962233363e4793d9ec49bc1b8db1fd910ed3
SHA51219a6f08ec2748d3f897b312ecfaf20630fdb5c6b8cbc1b24a676b493f414b43e16086d91d231df95e3572b4fd2fe5e975ef89937b24d908b6b48302d6a605829