Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/05/2024, 14:10

240531-rgvcgaah9y 3

31/05/2024, 14:06

240531-revkfsbe56 1

Analysis

  • max time kernel
    112s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 14:06

General

  • Target

    https://www.google.com/maps/search/50.8505,4.3488?sa=X&ved=1t:242&ictx=111

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 56 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/maps/search/50.8505,4.3488?sa=X&ved=1t:242&ictx=111
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadc09ab58,0x7ffadc09ab68,0x7ffadc09ab78
      2⤵
        PID:4520
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1720,i,4759147026598094337,6447043231325143104,131072 /prefetch:2
        2⤵
          PID:1464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1720,i,4759147026598094337,6447043231325143104,131072 /prefetch:8
          2⤵
            PID:4856
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1720,i,4759147026598094337,6447043231325143104,131072 /prefetch:8
            2⤵
              PID:4792
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1720,i,4759147026598094337,6447043231325143104,131072 /prefetch:1
              2⤵
                PID:4224
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1720,i,4759147026598094337,6447043231325143104,131072 /prefetch:1
                2⤵
                  PID:4420
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1720,i,4759147026598094337,6447043231325143104,131072 /prefetch:1
                  2⤵
                    PID:2568
                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                  1⤵
                    PID:2336
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\SplitExpand.bat" "
                    1⤵
                      PID:4292
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\SplitExpand.bat" "
                      1⤵
                        PID:1052
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x2f8 0x40c
                        1⤵
                          PID:2228
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\start.txt
                          1⤵
                          • Modifies registry class
                          • Opens file in notepad (likely ransom note)
                          • Suspicious use of SetWindowsHookEx
                          PID:4200
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\crash.txt
                          1⤵
                          • Modifies registry class
                          • Opens file in notepad (likely ransom note)
                          • Suspicious use of SetWindowsHookEx
                          PID:2184
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\start.bat" "
                          1⤵
                            PID:1400
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /K crash.bat
                              2⤵
                                PID:3156
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe
                                  3⤵
                                    PID:3300
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe
                                    3⤵
                                      PID:3776
                                    • C:\Windows\system32\cmd.exe
                                      cmd.exe
                                      3⤵
                                        PID:4672
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe
                                        3⤵
                                          PID:3752
                                        • C:\Windows\system32\cmd.exe
                                          cmd.exe
                                          3⤵
                                            PID:1996
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe
                                            3⤵
                                              PID:4292
                                            • C:\Windows\system32\cmd.exe
                                              cmd.exe
                                              3⤵
                                                PID:1704
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe
                                                3⤵
                                                  PID:2316
                                                • C:\Windows\system32\cmd.exe
                                                  cmd.exe
                                                  3⤵
                                                    PID:4948
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe
                                                    3⤵
                                                      PID:3656
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd.exe
                                                      3⤵
                                                        PID:228
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd.exe
                                                        3⤵
                                                          PID:4560
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd.exe
                                                          3⤵
                                                            PID:4384
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd.exe
                                                            3⤵
                                                              PID:2352
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd.exe
                                                              3⤵
                                                                PID:1220
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd.exe
                                                                3⤵
                                                                  PID:2876
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd.exe
                                                                  3⤵
                                                                    PID:5028
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd.exe
                                                                    3⤵
                                                                      PID:5084
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd.exe
                                                                      3⤵
                                                                        PID:3500
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd.exe
                                                                        3⤵
                                                                          PID:4220
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd.exe
                                                                          3⤵
                                                                            PID:4820
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd.exe
                                                                            3⤵
                                                                              PID:1928
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd.exe
                                                                              3⤵
                                                                                PID:1056
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd.exe
                                                                                3⤵
                                                                                  PID:1204
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd.exe
                                                                                  3⤵
                                                                                    PID:3400
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd.exe
                                                                                    3⤵
                                                                                      PID:3268
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd.exe
                                                                                      3⤵
                                                                                        PID:3628
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd.exe
                                                                                        3⤵
                                                                                          PID:2548
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd.exe
                                                                                          3⤵
                                                                                            PID:3788
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd.exe
                                                                                            3⤵
                                                                                              PID:1188
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd.exe
                                                                                              3⤵
                                                                                                PID:844
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd.exe
                                                                                                3⤵
                                                                                                  PID:4064
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  cmd.exe
                                                                                                  3⤵
                                                                                                    PID:1664
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    cmd.exe
                                                                                                    3⤵
                                                                                                      PID:2936
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd.exe
                                                                                                      3⤵
                                                                                                        PID:4660
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe
                                                                                                        3⤵
                                                                                                          PID:1044
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd.exe
                                                                                                          3⤵
                                                                                                            PID:3128
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd.exe
                                                                                                            3⤵
                                                                                                              PID:948
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd.exe
                                                                                                              3⤵
                                                                                                                PID:4572
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd.exe
                                                                                                                3⤵
                                                                                                                  PID:3112
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd.exe
                                                                                                                  3⤵
                                                                                                                    PID:4348
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd.exe
                                                                                                                    3⤵
                                                                                                                      PID:5208
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd.exe
                                                                                                                      3⤵
                                                                                                                        PID:5232
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd.exe
                                                                                                                        3⤵
                                                                                                                          PID:5380
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          cmd.exe
                                                                                                                          3⤵
                                                                                                                            PID:5388
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            cmd.exe
                                                                                                                            3⤵
                                                                                                                              PID:5420
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd.exe
                                                                                                                              3⤵
                                                                                                                                PID:5460
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                cmd.exe
                                                                                                                                3⤵
                                                                                                                                  PID:5568
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:5596
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:5604
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:5676
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:5700
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          cmd.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:5792
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:5820
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:5836
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:5876
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  cmd.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5956
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5972
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd.exe
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5992
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6008
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6036
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            cmd.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6148
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              cmd.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:6160
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd.exe
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6200
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  cmd.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6268
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    cmd.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6284
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      cmd.exe
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:6344
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        cmd.exe
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:6380
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          cmd.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6532
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:6580
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              cmd.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6596
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                cmd.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6612
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6632
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6656
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6684
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6704
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6736
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6796
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:7064
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:7084
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7092
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:7100
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:7108
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:7116
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:7148
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:7156
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:7164
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:6172
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:6224
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6840
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:7540
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:7556
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:7572
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:7596
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:7628
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:7644
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:7672
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:7692
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:7712
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:7720
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:7760
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:7796
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:7916
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:8168
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:8176
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:8184
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:6628
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:7304
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:6624
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:6912
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:6800
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:6888
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:7420
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:7060
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6656
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:7220
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:6316
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:7624
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:7740
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:7872
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:6428
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:7876
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:7504
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:6604
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:7784
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:8204
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:8220
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:8236
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:8856
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:8864
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:8872
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:8880
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:8888
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:8904
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:8920
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:8928
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:8936
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:8944
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:8968
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:9000
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:9032
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:9040
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:9048
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:9060
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:9068
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:9096
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:9128
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:408

                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      192B

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      dafc43137efa48ada116fd87b59be4f5

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      f18ace2ab7fc6fa652c12c27934939ae4ca36dc6

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      cbdedaf0422249e545eb048b1cb8f9bac194ce362fa3444647a90cd0488f0ed4

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      14a5ed2d775d65cd781e2998ab9d00e059b5840e82fe7b5d481c7f22feb3778e08afc081dba6f4ca4d0ff4a1c2cc34ad166ee8ff9ab739bea04e16eca32e6ea2

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      264KB

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      71a2597fd774711af62da97c69900ac4

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      90774712bf8f7097a1250bf113bf0ec91b8d7081

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      37a3cad68ac98761150359c4c4cc1bd99ff143a23e9a57294e32856f297af90b

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      149e70b1110e798c425c6e83d62779fdd25b6901a57880415b6690893688dd8ec8d83a6b0b79415c44105214a0f0fedac2f9d5768a0aea6263002bddf74254c2

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      2B

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      aa2477116124757d8b0156b512f3ce59

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      573e55f8e5024ebd59738d7ec4f816b47b5d7db7

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      6ca0e881e655d16023ee338955aac2183e80ffeec86c367704108e6d1042b529

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      f3def456c5f086c29aaed0f63eb01642ddd540726e44b4b107269c5118da1646436aaf0c036d51c6b432df9f9aecdd4eb8f44c95169f84c8ced78a367fbf5110

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      130KB

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      8d5eb550cf244943925372042d7e70c0

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      52d8f317b5488055925da948ab3b97e3fc393d49

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      791573b861b9f4e7b490071e7f3d26028ae3c238aa0924c25a297d4b0e1b62d2

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      852264b73974faec46a0ec4611a5a5d52faf6ab87d3fa6bca89ed490a2b8d582be5efe6b816ead9fd2934e4b898d62fb9c37c4ecafbb2a7b75a3e89e6ed3cba9

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\crash.bat

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      25B

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      86015e62e17fe75e3a9511ae2a833c2d

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      ee7791b973a8caa47295bf3e263efb28803fe250

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      b34b703b4ffe2c02c2d4e2f2bd21ebcf054535b82997117a5271002cb2176531

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      2aede8bebeeb93b71e1f502593921c105f844337fd4d055f1dce9adfe19495738bc691cf1c39b9a7fbb3bcf8be597f84f7bf123ec03cdbfd245868450cd1bfde

                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\start.bat

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      38B

                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                      d118a0ba82aaf04a3fe1725f69aba6b2

                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                      981c819968ad6946c14d3907c8514ebcf864787d

                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                      8bb0e24313916f6b3e36c09bb34997cdbba612e4770eee22d2aa2744e784f275

                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                      e0c6e4336dab37bb723849af8293b8d35f641e6aec46d2657af601c7cfcb75be9b630399030588d9369b955609f4fffe6cf58688a186f8054d00581959ae8195