Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
64s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
chiptone.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
chiptone.html
Resource
win10v2004-20231215-en
General
-
Target
chiptone.html
-
Size
120KB
-
MD5
19d617bce2c8a86e74bf284f27c1d7a9
-
SHA1
178696b04a124398d0fd2bef200681af6f60d528
-
SHA256
bc6d24dfbe46960ef61d4819e08e7a3fa81b178f3382d62e491561127c6affa9
-
SHA512
3c9db3c7fd724c2229fe37f0dbedb77b8645fe3a2d4df9628fa18db3eea2cca0fd5988f505d2f2518a4a83ef97ad44e6930bb6122a4c50c8350174e5f5e90d8e
-
SSDEEP
1536:guVqTZR72L5W8AZ09Pg06tN9SIw74+ZMY6DYgVEJF1lSIbbLK4oAqHonEZZN8ISt:w9SIw74+ZMY6+r2SyAIq
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 3060 setup_wm.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1736 1680 chrome.exe 28 PID 1680 wrote to memory of 1736 1680 chrome.exe 28 PID 1680 wrote to memory of 1736 1680 chrome.exe 28 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2680 1680 chrome.exe 30 PID 1680 wrote to memory of 2612 1680 chrome.exe 31 PID 1680 wrote to memory of 2612 1680 chrome.exe 31 PID 1680 wrote to memory of 2612 1680 chrome.exe 31 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32 PID 1680 wrote to memory of 3004 1680 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\chiptone.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6669758,0x7fef6669768,0x7fef66697782⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:22⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2200 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2192 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:22⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3232 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4344 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4484 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3876 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1504 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2664 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2380 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:82⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4500 --field-trial-handle=1348,i,2531101426533717150,10388496506958302201,131072 /prefetch:12⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2928
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵PID:980
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵
- Suspicious use of FindShellTrayWindow
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59288904c91a2c53399f2003a00781941
SHA103df2aafff68942712a397574a7db6cdceef4a9f
SHA2566db2f733f361e63825508e0341ddd2ff9e73d1bbff83272d4cf5eb2a41f64c36
SHA51258f3c02efdd70799fdcf1e328581edd150e0656951936e30efa3224419c66d3dd3ae9af7162a4f453ebccea7f1c7d9f2bb7b424062caa753685463531cd08376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5385dc6f0972485bf5a6818d6aa63deb2
SHA1818a4dbb7cbeefa3248e38be46c4234fe4a833f8
SHA2562ea8a77b99cd068fb529c171b496b5d8a7d056e1121bae6dce9ea135826c7c89
SHA5121f096b8b3985008517a98a42acefe69dfd51d889d99d07d304421f62fecdcd19e3f2a7e45b60d2b3aeb4f4d5dab403718344a1cad943dc39ec6d37a1991551fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53511bb05713fb642c9b5fde6389623dc
SHA1fa4b9c88c426c87ef9079e5bc66332e01488e68b
SHA2569bf17b846a50abb1c897ab35682527e51a3fe13809b527894078889bf0e36ee6
SHA5129e4988d714b6e893308f9612fb943218e2e5364723208123a663cc53cb2690611b858eda2df976c5699fb0f8fc59b358eb7a7edbb0bd7ec44680ef9a1c31e5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD50171e9d19edf99f6b754385a57105786
SHA12a04747d5c8e41f427c0bc1d066061673c030d6b
SHA256f5fee1a556737fa38dae227eaab88eecfeb8745e101ede0012257c237ba361ff
SHA512ddbe2cfde9a7477cfa307a265fe2937c2ec64b993c6205ce133d31e295eabb288c676a65fa80c91ed40775e7c2b9aabb43fc01620dd11464a8f388067a69c1b9
-
Filesize
193KB
MD57fe2c36271aa8065b034ce9efdbd2a07
SHA1e22ee654cb122d0d62393dd8d6753d2bcad148a3
SHA25602cf672988303d8fbdbc7625f54596ece6d83c78152ca6e1aa332fc8c75d5c34
SHA51245d53a09ced29138e2f99e0e8a293322050f8032e006df06315ac9af2f1ab64d1c767ea5db53289bb5881a4866061299e5a60cd83753fe6ba88e8de7562706ec
-
Filesize
144B
MD5e3b1bdd8361f7e99bcca41bab5d093f7
SHA174aa1f62e4f5806df03f2df558f02a47cb40c816
SHA25623cf0da1dfb0c4e2b9b6b2a2e7539f3e09f1e3349621045f9717f3e515e90f9a
SHA512005c4c98b3d0f6f89b31f74844e3e523099a7260e026e9d3c49470c7c5745c071124d23f74251d802d10185afb009057c68e4672daec0bc2614a355f5fa8e8de
-
Filesize
264B
MD595f9556cd49a914870b363c9fcefa0e5
SHA1786aab2a384e613efe2133e95c979e042ac67cbf
SHA25685e3e33be4fb5576dfcb2507d04222392bbcbecb5769fe8f03c7170bc6258dfa
SHA512eca4a12a24e0ee1c35dd1ade91a4b41cb8ca697c2461236bcf6207764358e7efe1c59f34b84ae529ac556df44e762cb09d0b0f653221b2c06b3e37301366c556
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube-nocookie.com_0.indexeddb.leveldb\CURRENT~RFf774154.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD595ee8460964f56515ef0de412761e436
SHA142da96171293cb856dd0cf455ff8ac104d0f9d4a
SHA2562543175d8518d32cc5941721d60d7398176239fd725317267e8b6a9c048c137a
SHA51206f8d1efb5b8c900b9452945a131d73c2539b4571b19106094ec8b74b3888def9443f23d036c3ddecf40722c0f3f1f552820c02c1010ecd5ce370a16559ce721
-
Filesize
363B
MD5523825d2df3b145e53e1f585402155da
SHA173b622f2a43ba55e8e40a7285b5e08aaba5ca8da
SHA2564ddf6edfa180efa349de879dd9bf645049e78c3b6762d485dde71a55264a59e4
SHA51296633376d6fa458300f3c22b5af202dbff9187e5e388304682363a940ef9750c30ac5b537ca49359a541278fce9ebec5e2bd80f37968fffb0397532927c1153d
-
Filesize
690B
MD548c1e100102c126793f838201e43f608
SHA1fdaa91d1225d69e0fe30c90a3a145658dd5fa5e2
SHA256dfd49e66c6c9ba66b9962fb67fcd658508e64be5c7a1687039045b553a1f908d
SHA512dd3b09dafbb38ec58fe4ee3a3eaac0bd3195f86a5055c062bb7c9a794dec6f56915729a612115a36504a7b354c40b94411c22890dbb08561979490c87165319f
-
Filesize
363B
MD59f615fc2477914c37e873c99d9abae08
SHA1ed753f8a96949f411fd3e561c03af737e455362d
SHA256c651420c542880dc8421d43fd8bd89c3a9c7bc405a82c1aa143edc1067b48433
SHA512a018ea26736624a783d353bb78013b26a65170721a767b0e406be06e817277376bcbad9d08ab52865e00530cc341edb6b0d0cf0f7ebbd0387a51d86c05d71359
-
Filesize
690B
MD563019d5ccca583c6dddaa5d68d4f6288
SHA1e23edab031755b20702e2212be8e9122cb1d9845
SHA256dcd7dce4f9d184c2171c99bf6302e3e314e0a1f4175cfca2b3117b2ecccefdd8
SHA5120bd5fe6f66777e7be433a0483c1c309d180685a028a7f73b8cddd4f1be8ed182e3c748f1a33a023426133f9bd508ebf94f6cc398c79112b31394a415fb211284
-
Filesize
690B
MD549155c5b4cf7adea5069137f15b27b4c
SHA13c36a7d944dd1a5259907c14cbe1246049962f17
SHA2567dc9d9e6f2327cd40f2ca219e362420c55933a7d2bc0f9f7bd16e2e9018caf98
SHA5123a046161303d90599d9d4eda4f721b37f0a975fce59d2c73f15d1f8bdd15cc24f0b2bf86557bfa81ded92dea17839ea394cda24f953f8e2f5269b96a3bd5b22b
-
Filesize
5KB
MD5832c0ca758352b716a84dc679fc607f5
SHA115d934abf4fc07f5a2736f3065043c6366c7e668
SHA25626d21237265df9b04f3ef3988315ed2c4ad6eb7185d77480ddddc95896a493ba
SHA512d34311343b3b2dc9a0c3443b174e4409d2f4db9b893b7c84d4df0b5fa3ef6fdd430789b666cf75a338cda478802b35fe18a22e96033b4d17df6056d5268bd3c4
-
Filesize
6KB
MD52a0cf87230ee08231e5520af916544b6
SHA16a176c000cccdeb7625fb9e62286e9ba4b5a9460
SHA25638162154c47f86c6257dacbf8d9110af2e4c09948218c8bb52cc24d12a5f8f20
SHA51295bc578c0784c8aadc4934c82f8d1f4122600e0231b2dc1a17fb03972c7c18928c8d170e55f421ec51c37c0282f58def1a8578efd8b7a859e8a5273d27abc3a8
-
Filesize
6KB
MD5cc1e0ffd76aeee69c1a02c3756c3f5d7
SHA17c3a0ce3f02b067178c61ac1a6a6234d1ed347af
SHA256e61804432b42fb719b762e6da3a748931c84994e1fa5804ccc653a939d795032
SHA51283ff2b73f45385cc4a369e47aca980fe5f5a896712b832a6e553e5ec9e5bc2a5025fe5e1e302f7ba9be65ef7004ed3ec3bea19854fb68f2f04a9b1c3c86331ae
-
Filesize
5KB
MD53e267888613e0628702e00b9ca2360b0
SHA174badc7f6a4adf305203189577172e76f902c774
SHA25660fc62c8c87859456c4ba4622db77e1bfbbe81e86d4f66b5c4de98a0dc6e02ba
SHA5124cce42d5de8e33b1ddb5d181dd3a1c5f1d5f70d4c9a863dc6505c3f369ce99a2fbec2bc901cce7d3853ea38a919771adf180d56830c0262c8136cc9656acbd1d
-
Filesize
5KB
MD5c183025771781ff024384b9be1a402f2
SHA1ad4e9642bfe9290806c774ab901a7756fc771ab9
SHA256c6a27e7be53bb9bd9626607ef5387d4f216e74df2952df1b10499cf97d58161d
SHA5120c29e8b2458ee02bec1739e4cc9dacadfe1fe23cdec06c7227e1276a8271d60d321f6432e061529d324acd28f5efee5b7162467ec45e348493244ec97c3d8ac7
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
3KB
MD57da08e41a97577b5d8b1e86d74214a15
SHA1c49ee46349c30bcfa1aad838b04229a490f97c0e
SHA256dc9e2f0a9e0bd1e5094447731eff3565c08cc58b55f731af0518af32444b299f
SHA512224800ba2d35ddc7e8e103e80713669dbd5c0424f5255af8b9057ec82b4705d93c4250e84071be4c216b9dfbc81a65d7327cf9f5afe8e7ca766b600ee5485c0d
-
Filesize
3KB
MD560d80bdc4b6231febfa2fe4f4052604c
SHA1611335a7a67d808f8fd1d6a4d2c4accb68455770
SHA256e9fc1c96ae93fa4ff8454ccbf81f61c95b6d0b050242f3432d30157a5386319f
SHA5121e11cf0a8edcdb13acdbffee7167f80b78a83db07a018a4b2db197fe595630b3f6d1ba3284d35fdb611d6773701a26ae2b0901320a9bd164bbe639e8e119eeaf
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
546B
MD5df03e65b8e082f24dab09c57bc9c6241
SHA16b0dacbf38744c9a381830e6a5dc4c71bd7cedbf
SHA256155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba
SHA512ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99
-
Filesize
523B
MD5d58da90d6dc51f97cb84dfbffe2b2300
SHA15f86b06b992a3146cb698a99932ead57a5ec4666
SHA25693acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad
SHA5127f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636