Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
302s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 22:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://softport.fun/qw2q9Y
Resource
win10v2004-20240508-en
General
-
Target
https://softport.fun/qw2q9Y
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617531612671147" chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1224 msedge.exe 1224 msedge.exe 684 msedge.exe 684 msedge.exe 5480 identity_helper.exe 5480 identity_helper.exe 6132 chrome.exe 6132 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 6132 chrome.exe Token: SeCreatePagefilePrivilege 6132 chrome.exe Token: SeShutdownPrivilege 6132 chrome.exe Token: SeCreatePagefilePrivilege 6132 chrome.exe Token: SeShutdownPrivilege 6132 chrome.exe Token: SeCreatePagefilePrivilege 6132 chrome.exe Token: SeShutdownPrivilege 6132 chrome.exe Token: SeCreatePagefilePrivilege 6132 chrome.exe Token: SeShutdownPrivilege 6132 chrome.exe Token: SeCreatePagefilePrivilege 6132 chrome.exe Token: SeShutdownPrivilege 6132 chrome.exe Token: SeCreatePagefilePrivilege 6132 chrome.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 684 msedge.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe 6132 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 684 wrote to memory of 3108 684 msedge.exe 84 PID 684 wrote to memory of 3108 684 msedge.exe 84 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 5388 684 msedge.exe 85 PID 684 wrote to memory of 1224 684 msedge.exe 86 PID 684 wrote to memory of 1224 684 msedge.exe 86 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87 PID 684 wrote to memory of 5624 684 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://softport.fun/qw2q9Y1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa12ce46f8,0x7ffa12ce4708,0x7ffa12ce47182⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:5388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:5624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:6108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,17392589316658874251,13708066219086632131,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5836 /prefetch:82⤵PID:4568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6132 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa01b0ab58,0x7ffa01b0ab68,0x7ffa01b0ab782⤵PID:6136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:22⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2144 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:12⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:12⤵PID:6044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:12⤵PID:6040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4252 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4804 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4112 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:12⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:1348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5072 --field-trial-handle=1920,i,1408783925310072068,12904995024132974207,131072 /prefetch:82⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD5f62d0464faf18fb35512309b1bb8968a
SHA1c6bfd9504611fdc5b8225b0dbbbc61bee9bc7b3b
SHA256b1f029d218c2e2db1fd76c78fa731a3bb86b7f05464cf6c120947dbdcf5f97ec
SHA512ed8ff0739ad3ab45d4c7735bf86cb7267d2aece59e36fa8eabf87de1762597afc04e18848d7171e2f61f422612798825c7c0d276a84b8c47e3592a1cd7838420
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\82adcae9-c144-4e8c-a795-714478504ec4.tmp
Filesize1KB
MD507597ebfa074d661193f7aba92bdd063
SHA18fd4c785759ae9e76845a05cd99001b47645d0b1
SHA256c0c91144f63bd3390d69068ad4f15e855fb5e17ddc8510d416e8dddbbd8409ba
SHA512983c468847acbc13ed3034c763db6ee4e9e7235f0d93de99f025d23b3451bacf557284fd0239f92004177163e927778abd9acddcb40924fd8e1f1a695ed39ba7
-
Filesize
4KB
MD5b8f2d419495fa1c784b7a55d0175ae48
SHA13e39f2da5c0e3b9151a34009d2aa21484535a276
SHA2568b1f7d21b82e20ad9dcbc40abbc74a773fe79cdd0ec6f72025c1cd0f0ee445c2
SHA512710962995f0fdec05e2a65942c9e10024df9b9fcdd6fe2d822521d0e2b052ba9b33fd2000ffc7ba4ab5867c2b755f2c3844caa840ae5e4e9590aae3c22b19939
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5969939ac9810a13c181564b48df3c9bf
SHA1d09ad50ed75878d0e1bd908678ebd156278e1258
SHA2567db31d94ca30b518d689db3304ec38e18af9974480a83dd8e077369fa712033d
SHA5125e3898768da0210538a58f83a2a586305986b9d6c70a2081ed476f34472f493cac1c99b6958dd018513f825811d7cb59af0111c25eb425c5871cde5ed1e0d371
-
Filesize
255KB
MD50ab82a2ca7d030727a4d82483956cabb
SHA1f48de099b124ca6d2036977cfde72f4e030bbde9
SHA2562aaae3ea50826c5a47b9e5b488f41990fb5e0fb49399dcdafe0636add27469b2
SHA512e848453edc2b9a19869d0cf6e969c061ccfc1468249d5498fe5bc012305d66c0651201c165792da0f7607735f4ea5cd8e29bc1657502ba5908a9e730bcfe6185
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD577c5f10f9ab82b63342e426112bec6c1
SHA1be143151007f8b912f267c9ec9a280324d148ad7
SHA256181543e7ab844913a5aec036dc8edb63e66d24cc1f685b39619d42ee8002cf7a
SHA512b2cb1eed99b3086169923b8525bca7a97c8aac9c666b00c77135e16c44de4f44faab3ff20bf5783d750b6a150d0def272bec5060f576768aac5c05f10dd5cc74
-
Filesize
3KB
MD54f88a7be128e2a1348f894601b59d97d
SHA1bae488af2ed00ba53a2998cc6786c09a742c54f1
SHA2560e625c13727749c41533e5f51672337cc9aea6976d5d1d88818810e9c3a31963
SHA512eb24206526a6273dd8f88314eee03a78a4d92c86345df10b78048adaae3cf81fd95c3ffc33be4117015269f786a5267f8eabff0ac7edf7984c7a45105413dc33
-
Filesize
5KB
MD56e68153a0bb332fb0bc6ef7cbaf62bb2
SHA199ce987598acde53a14973bb38980a0606e04553
SHA256176ceb0b88a1a9c1769fce0e02e1d692b0f1b2f8a70a53ba1fd39956c228373f
SHA512f2edb490d8a7f217729544ba0b48d6b5d73e1c77f32ab306c1de4a146939e9fc4cc222c72e9e5d4765fbfba078ac46bbf73f3ac3792e989fe38aeef425343348
-
Filesize
7KB
MD5c1995b304978770e994a511d1c7448ff
SHA1daff1de7a578a2354309f4aae71b8a4b3665c683
SHA256007c16985ad2c66582ce3ce9e779d8d5e5cbb42418729e55484e997803af187b
SHA5123e417b52ecbeb578fda4f277c334c0d12d96f419a67c019c2518b497240538cf8e2a59cfa4bfcb418adc7fb76c39842435fea92b66c10841178e5c99bd34dbb3
-
Filesize
7KB
MD544e65beb2d10fd61c29fe23118872ec8
SHA1d4d74b66a7bba021dfb76841bbf56fcb9d310c0f
SHA25680450c483139bfe4e917fc14c46c5c6cbe2dbaa804095e7845e083eba2dd8a04
SHA512738b9f5695ef3e8d5a37aee1808a5dfd33243dfb1320a2a157b3dc6a659893a18ba0aed42ef591cc44cf0263ee33e12a5081ea14ec58e7667db26b8d375d63aa
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5841f956c352bbb1eb4919eb41b417f99
SHA1b25ded1e6a172b13a26e96a6dc57251b1fe1e653
SHA25694b9cab79ace8951e311479f912f240bd01ad080b5d0ffaa95cbb3d08cb2ef7c
SHA512d39beef8f9a9a1e8299d125d1bfbc4d03817ee908991834454a93e2ab0007166711a07261707d3a6c42280ca7323f381bac2f6c73ef07876927fcf5123307326
-
Filesize
11KB
MD590d5344dad42487210802ddcb37126fa
SHA12cd1a14fad2443a2bae2d6b2922bed3c5b558509
SHA25616325ab4a4e341b2e5c627d31b7cd05714267ec17bcb69d6f4ae5de0f3a0a0e2
SHA5125687f72a1ac32d8b3adf6f2b159827fa47df7fe27fac9186cc1d4fb33be6aa8aebf2e9b27dcc66d18f06a89ddaa09fd3617c8a81635b1f5c8a55dd536bed2721