Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 00:54
Static task
static1
Behavioral task
behavioral1
Sample
how-i-created-youtube-premium-accounts-without-validating-card-46d1095665b5.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
how-i-created-youtube-premium-accounts-without-validating-card-46d1095665b5.html
Resource
win10v2004-20240226-en
General
-
Target
how-i-created-youtube-premium-accounts-without-validating-card-46d1095665b5.html
-
Size
129KB
-
MD5
3878eed67bbfdd0e01ec7c340d5c9ac3
-
SHA1
ec1c28e4294281f3a5dd9ef21f1dcb8b0e602dbc
-
SHA256
23cd438e1f297de376352fe230863d6d2fa543c45f6c83d4d3a241c90ff5e1d5
-
SHA512
4cce37210b63c50c0eff49f2c93012c846ea5c464788406e1ec749bfaee8032f838a2dba6078cf7e42b4b29ab93ca1cee7d92ce7c3297b5ef9554fed8a285ef6
-
SSDEEP
3072:bsBi/PgHYZ4ORiPgrPgFzKawhhkrKGhYHZ+XFUxHsRJvrnc9D6IJbUb595etJ:gwZ4ORR/x
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000145984a0f2cf7c459bed1a5c87a7c57b00000000020000000000106600000001000020000000cdfdb3f91b91088e1e35db00862c605fb4672676c1c493d8c3c823ea7d1496be000000000e8000000002000020000000169d08ad07a5b8f77d42d9f7056fab425cbceabda315db8452179d1d70c3f6f190000000cbe2d4c01018fade2467d3a32215f9594cee73bd9ce0ac08a07461304163d1b0997eff4c08db0801786741077457540950228e420484cdf33b7389bd3021395a05f0e330d1a37745169b2f8f8a491303180d8ceb05a20cf06f470821bf440450e9bdf5e2d981576c7179c7e50980ec08d62f7686f57941e09890c9681af9373ca5e11a03c934947949ef982ba41d21c340000000c788eef7f40c6f8ad25fee6db5f76ca9a493a542ddce899d9d9549c2aad4eb725086a9b10c8840ddda68ad8bd0d1aba4ab19953b6c5873c600a018823c7d87be iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24CF2D21-278D-11EF-9A4D-7A846B3196C4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000145984a0f2cf7c459bed1a5c87a7c57b00000000020000000000106600000001000020000000d68e64d2bbe8b986e64218c3020f6c6a5d6561400d6d2fee6cddfa22bc5684b5000000000e80000000020000200000006aad716e5cecc06341d060874265f992a4942081acacf71fb13763fb106d817620000000574df0527e0e4134266d4cce4d4b50821fcd38fda21f8d83f67857e60666fe4940000000c5496eff4243da72ff9dee26c9a823ba1a22bdb7951fa7f0c325988729b8629517b1c80ecf373cd0349e4a0c9aeff878b3fd519f93a5128590f0f3bf4fa60844 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d713fc99bbda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424229134" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 332 chrome.exe 332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2924 iexplore.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2924 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2444 2924 iexplore.exe 28 PID 2924 wrote to memory of 2444 2924 iexplore.exe 28 PID 2924 wrote to memory of 2444 2924 iexplore.exe 28 PID 2924 wrote to memory of 2444 2924 iexplore.exe 28 PID 332 wrote to memory of 1548 332 chrome.exe 33 PID 332 wrote to memory of 1548 332 chrome.exe 33 PID 332 wrote to memory of 1548 332 chrome.exe 33 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 1248 332 chrome.exe 35 PID 332 wrote to memory of 2312 332 chrome.exe 36 PID 332 wrote to memory of 2312 332 chrome.exe 36 PID 332 wrote to memory of 2312 332 chrome.exe 36 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37 PID 332 wrote to memory of 1820 332 chrome.exe 37
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\how-i-created-youtube-premium-accounts-without-validating-card-46d1095665b5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63a9758,0x7fef63a9768,0x7fef63a97782⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1224 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:22⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2168 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:12⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2176 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:12⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1484 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:22⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3364 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:12⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3500 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3624 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:82⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:3060
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fee7688,0x13fee7698,0x13fee76a83⤵PID:3036
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3644 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:12⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2536 --field-trial-handle=1280,i,711696495308729586,4883642455075599473,131072 /prefetch:12⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize1KB
MD537d5b341baaee2faf4890e6a15457689
SHA16cfcd250fd56290c868ed32c9b311035f9e36946
SHA25624f3890386e1e04693fbd45aad8824ff772b016c34c6087a5fa9c2c601a2cab6
SHA5123957b50149a8c74e746e66ae0bf5ae6f48907b29a48eb55469f2a120bd320c545dbe562d3b497d12962d977c72281c6e8842c453892452f60c4eb59a4d2315c7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52d11f21525b2b42be340361de3698791
SHA199aa0abae3b825380794c265ad282cd527d8406b
SHA25617299422d06693a2e0706ae013c9ea216bc0f3b195a4db81f03598e2a1271d4d
SHA51228d0996ed5a7114408838420d1c25f7767b2fa0138520df23df262454367aded3c1cddac3e75280693c666dfd874fac79740f025515d3a88b09e96a11e8c3a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c82e9f4bd42f90ed02f96a0346a0c446
SHA101969854e64e4d192803e7c972a78972560d9c56
SHA2561bb7a12a30fb5eeeaadc33f17a3a103ba0fbd195c2c5e39c886bbb4dfda89c88
SHA512ee79a1e80da87d8bf4cb7348de2fca9610b1f8c92f4d8daedf8333ba08e434acb7fb20a901d1004f0d0a581a34d1251df3fdb0bd594b55cb385cc669d295754e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57abe0c71cb14253b1f37ba39e1a66cf2
SHA1db2208705daab05acae3d6541a7fa35fbc8198ba
SHA2561d81924f5cbe4c1b33662d57445b0d5014c7bddeefb7fbf683477fa20064c321
SHA5126f85d4b71bda00cd58e206803955c42d2e1ee4d4a3000ed583c87c4e8403c546cb53bf870c00e7a52d4d0802017fe4b58e575720b2d0a8a017f6fdf7cababf8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5986165815cb6652ff908e7be3f09ed63
SHA1d70fa7aae957e8fdf55c50c60465a0bdd8f30ed7
SHA256479a3e9e87bfe9c44bdf5324b79df009cfc30330e7395ad13976da17919dc1ad
SHA5120ef1fe86af64e17826e295aefc3142847a296cb1ff00371264ea99a10624fb5b27d60e502a71729d749cd1d7403a12ca1af060997e8243fecd85924793413742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e737092f77ffb5ad96a9e2046135ecd
SHA1fe8d4f59cc317a1c56b3bf7a822a988c03c67936
SHA2566ebfa6e02f61ee3d68eb7a5128b73eed55e4d75c18ba9acb1033b1fb83d2a0e2
SHA5121f63217dbf51287399122d4363a7995f85440bd15536530dd0f385281dbb0ac83c5dc42375828732647f9588b64ef32fd27fe51a152c017e617d7705b8976379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540cde41d7d258937343c7bebfebae478
SHA110c1e6c7db00e394f777043833d12a37c8c3558b
SHA2569ed24c79ab5875790e27ca6f236fce12c5b30fee7d999ace574774d15052eeb9
SHA512781d80c9e7724673dac3adfb45a2d56c85dc0addf50ce106c570544feb5572d676592345388eaa0bcf60389b18f7e347d1601c389bfafdbc1b426214526bf809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555ed93de9d759d894f159b5cfe75a91d
SHA106b619908712c3716f96beae264f251a35454b7b
SHA2568ab9f2f6adce2b2d34a4b08b0a4c975496213152e5a2e296498c9e5bc6b2e080
SHA512d8cdb3b0f2542bbdfe83766dcba94c2c922161cd7a7ecb5ea4d22ab41a8d00f683b5bc3af79d22f3d9c8c3b6a85e0fee4673273aac0f9361d0e4cded37139787
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3963b12b18bdb484c7cb35ae423d0c8
SHA196edcbbf8eaa83fc2108c6f88a07169e8b1a9e66
SHA256e255a27070f61031d634bb8b4918f2512f3d0df6ed526423cc681bfce67d2c6f
SHA5123691b2622eafc1d15772da338c9ad350d7ef8f85d5c138f632ea0dd569322d92f00bb63d391b3b8abfe33ff4769d9488ed0f9f23165172d8d184fb6231f18984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ededb751a38249e87ecd745f921efa2b
SHA114465de9fb7363bb72a41a24d63cfc3af417fdef
SHA25699eb2f1d6f4f54012fe46f7df5d861f22adac6375a78ed6435122480e2389d11
SHA5123df1125552ef7295899a2f449eedea9f7fa40506cb5e592608acc1380b9c99aee0037bd097ca9cf23f0fb8e68176dfc6d6195ef1bb62c249624c995fde3fd822
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf7788ee.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
361B
MD5cdf3514364708b107a245f43980ec060
SHA1438243594d749ae051eca18505993e264768e1a1
SHA256458d73b0f8ba1e5a7f461e0ab0f70ba15300dc78a99efd94552e4411842b0bb5
SHA5129d52666ae97ffd6311666d29a1405ce11fb45e2283c49fbe3533de82ad3cfeee844d82081ef76505b95f5c09dcf9b44c7545219e6fee1777cd7bbbb0fada1838
-
Filesize
5KB
MD5339221725f0da01bb1c40586fa810ce4
SHA107bfa024e1daf795d5be97cd657a93e693145a09
SHA2566a5dcea539b8a5321fd308926212488bb2664da2460a23c3c7dc0ac31671ca36
SHA5127caec473f749d296d00e957eaa24462962e4bcd6cf45448bae43315a491f8b9cfb613657326f30fb70067e49b79c4ebb35700812443ef5f00bad3d31ccfac8fd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
274KB
MD5ba3770813943ab9abf3bfe3106b14347
SHA14f3d00e4a1407a93fcdab0692e071e2b3b3493fb
SHA256bd74fc50ec031e3c0e641c3b06321d516a9fba74441bb844aeb7138fc07519da
SHA512d41a925633c5eb3baa85cd0435eb88d64720a8e318e10e8184dd05d342c92d32b2179f5d0d816dc9d26d633076632332d605ef8cd42502492ae9594b06204f0e
-
Filesize
274KB
MD5ea3c7e6b04c3c0c3499e237c760b5d14
SHA1fe2e76366a090cea0c79ebfb91601df7f0d8e4c4
SHA25682757487e4454e441972bedde82bb3946e27c7beb708e9dcb9e00e2a7322e584
SHA512349c3693d1e2c76c847777cd09cf7aeba457deb7795cdd6272f41b8dcea686a05a0724554fe9cdb003d19405486791a39c4074efc426504d84a3b5d09ccfbee6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06