Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 21:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://dssd.de
Resource
win7-20240221-en
General
-
Target
http://dssd.de
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d0e52bd8a4c9da01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14E34AE1-3598-11EF-A30C-E60682B688C9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2212 chrome.exe 2212 chrome.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe Token: SeShutdownPrivilege 2212 chrome.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2588 iexplore.exe 2588 iexplore.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe 2212 chrome.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2588 iexplore.exe 2588 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2552 2588 iexplore.exe 28 PID 2588 wrote to memory of 2552 2588 iexplore.exe 28 PID 2588 wrote to memory of 2552 2588 iexplore.exe 28 PID 2588 wrote to memory of 2552 2588 iexplore.exe 28 PID 2212 wrote to memory of 2064 2212 chrome.exe 31 PID 2212 wrote to memory of 2064 2212 chrome.exe 31 PID 2212 wrote to memory of 2064 2212 chrome.exe 31 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 540 2212 chrome.exe 33 PID 2212 wrote to memory of 1556 2212 chrome.exe 34 PID 2212 wrote to memory of 1556 2212 chrome.exe 34 PID 2212 wrote to memory of 1556 2212 chrome.exe 34 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35 PID 2212 wrote to memory of 2444 2212 chrome.exe 35
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://dssd.de1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68f9758,0x7fef68f9768,0x7fef68f97782⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:22⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:82⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1548 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:82⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3216 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:22⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1392 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3424 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:82⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3996 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3684 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3672 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3964 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3416 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3660 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3364 --field-trial-handle=1104,i,4986574992614062018,10329154351404605285,131072 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
441KB
MD54604e676a0a7d18770853919e24ec465
SHA1415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA5123d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD59db0a2263cd84cdbe535d8094f89dd07
SHA11807b31128ffb10b77e25c99988861ae661391d2
SHA2568794cc76b0233f0b37046661c24219f7dfd5d940fb1dfc0a4e9d1c3b9676bc97
SHA512d30cfb535f4f32adb33eb3a065cd333c1a7ca5fd0ed6c21fdbf7069bc30eae1fe6b113d33f219c8081674f516c3e188a172d07f17a3bfa7cc05bec85c5031bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504b34f28a1f73d7bd5b79abc43c40734
SHA1eb4659e4b50af69a6029328c87b10823dae66be6
SHA256552835d374b8ebaa1062459d43dd90b6a9e5fa2580c8dec7ff7fcebd6a01fb37
SHA512cef8bd7b4f3646fd9db1fb5d5ced4a68c3e8b976d0dcc3a500c791210be8a4390d87c091f693a81e686277f52af40c5a3399880340bc71ff8f06277700dbc729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52db4de3607b6be2a8ec45c6bef569270
SHA122ddcf3204b63c73bff542c92f78c00fb0f4ff22
SHA256c754049515085f21ff26fc225a82dd2576f407f870b10946e55c599f0efeb04d
SHA512405fd14365bbef1740a48d7ff03d9299f490a5fd4af69c22d502d98ddda29e64144bd4f817df483881f4f3c08d2171e12f6f6c1a1f054b78eda63649d853d96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fac5605faf7133a3690fd9f61185204e
SHA13c13653d0133a5c1f91a687f08686daee90f9ce1
SHA2568b532566ac325692a226e8d0198bc5df41923c991c39045880a5e8d353634fb7
SHA512fa55475c330b9e9be5f729ead3f9c6ff69ec977872516953f2c6746f626cf97b257fe793fd86002293df9ec2a0afef1c220d6cb6a59576a9b759b9f4f00f8382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e29fb7130035f748662b77020152a54
SHA14e1bedfae7fc0b2da2031aa70b07df5fcf806761
SHA2560205b247552b51f9b2c52979df7f39c8a0d1cd83dc9b1c226e0577fc26bc4341
SHA512279262adda2bdbfd9e8a5d19383b57ee9c0e5b62736d50d9057f2364d009251679c7ea930990a5dcf108965cf49368ef049226f818514baebb35f8a9b565857d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc2dc61e34d6290ab9b723ada2d15205
SHA13c3e782be76f2c7a782328a125de402a560ccce4
SHA2566386516b8c54bbdc02aeb4c6200fa7fe3e2404c5f252c404b13f233d92b644b3
SHA5129533ceda9ae831e2f670b48a2be4af67bef1c2e1612a36f12c93beec0a391c55d9dc5ef6160095fde47cb3892cec188b16a46460538defb9de8d64922ce36335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecb94aebc556976d73b1a5bb049dab74
SHA1efb18304b0e4416d83f2862ef1b6b373447ad400
SHA256d4c11f6b7a2c98030c4bf3321325def7593fbae05170e9897cd3148b3fc2b238
SHA5124e3916ade4cc1f59867df55432326f4b521cd30023cab0c39b3baf5fc663727de358000b2da9cc0342a0348dfa400b26cce5dcfbfde9d2e9d1d1b8d8acd82882
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc970de4e81659b5e2ec73cfa3f0c98d
SHA10b56d35ad0a2c5a7cd0d5114134c91a4092d1beb
SHA25621bda30949b789c8f0b7fb6a68d213b9ff3fb8a7b4137f9eea171298d7e5010f
SHA512750fc25bb7385736ad4343f73bccf56490ca4ecd3b0795ce413842dae8fcaab16ef7f591f34abb23956f68566f7ddf5b2b7d540ec2000e4b56d09454aa39e1d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f6f3ffcb5a414f4508f4a30bab5e81f
SHA177b916047dfa640a7dbb2d40340d742948f9dd51
SHA25614c7100897f6e9655c64130c3e293a2452844920f3cc1f7752e70c2e66fc3d72
SHA51224fdab8df5b9d74751e5ee1a61e816ad5b2609bda6b105dafff292e1c0b917536e7008ccbd1c11d1af1b30df78e1d44ea83e86bd58077206446987bd1bd64fc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a0b0d0e7ddb04048540b036b811b63
SHA1cd4abb9b74055d0941c065cef392338dd8d6feae
SHA256baec404e9e492d93971bf130db234aaa815b94a8150e0fc959846b5ec1c5ac10
SHA512b1981ec1f939188866302a3c265478c46c56b10e09a506b7cf24e07743a79aa5e38ce2d50c84794f08f1e221fe72cefe7bddfaecd76e66a7d4228e1b20cf86fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b49678b4f57b19e6ab20e3610ef9f9d8
SHA1d0e10ee561d5f4f2d93a63fdb3cba4421261bd63
SHA25628fcea95b834147e536aeb7823adab2d0d7a1a83e0da530cf3ec7b437a57800d
SHA51262ce70aaedbc9cdf2b632ee4877e77255b9f234a07ad1771e9c7dccbbd23af7eef45520f9fac7aeafe6485bfa7a2779335058e4f77c05445442b7cb714ea9dfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579640cbb092ecb40e6a712526ab13cf5
SHA162c441f597d7e1129b58e5430e50f1f266f800e2
SHA256dab3276353f92e6a34b851dc6e310eb7b67b175904f3a57614371d49ea7f84a1
SHA512333d824c9b891dc01fd61273333a987c6c7316e65c633c32f94ea0f9b05e732d6c9796520ec3f418e25a680d8918441a6591cad60d1526e1b9e29e5f02ae0fc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1805aded4c0265a4f0f378b3a3e8e7c
SHA18a2e9576fa12251fdf28272ce2e0892a38414b3a
SHA2569974c545e61c8265719faf7adac158e91d462cf87da500708f7c96f7b01a5a19
SHA512debf9394bb4fb6e1f7f882ff60c4ff769efbac3fdf45d0a73a93df6f21ff8fa31f80b50e4440fe3cea9e0ecbe27b9c97caa7bff7054a483430cdd28a06e29ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547681d670874734a2ccf4adfc1017e99
SHA1a42afdab738f27ab5208c3469fe8de012f9be55d
SHA25687edfeae970e04c22a8d57ddeddd77b4bd0b609ac8c249d645b7c398450f00c1
SHA512039e29a7b714dcbec76a32d036596b815ba50f7003d2cfba04e7d4f9c640c6c180a6bf0a96c25e9d6ae3e95eadd5084961099aa45ec136e6052b76712b9fd4bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b574161111dbe7b8c75ff8b2cf068f8
SHA1543a1eed04b6aa80acdd2cae771ac0bbbf99ed8d
SHA2561d76ab78039f3bbb007c2ec67508494e81e389d6a81cb89c93fc78a1ef5ce4c2
SHA5121b2c6247e4fb2420e672fbe5a15da2f80e751987145313abb11a15c18fa3e5e42b815371b1c5679360f7a46710146697174d84e6ebaeaafe56dae7ab7288acb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571a6395ab2b9b49c40455b12b0f88edc
SHA176d98b1086dcc2a083a713a93b8ae5af10b6d187
SHA256b7cb81c587ea05f17c9459c39a17ae2244791ef776a36a9ec4cb0ce976a8ffe2
SHA512c5f416a125f590df6b6000e6976bb171a7c36b2018270438d89502828eac2a7f64cfdff1373db52aaf3cc9859ee978080539b7c972da880a37ecaf593a2ecd0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4a0883f75d7f25b14f5a6fffca28382
SHA15ede0f2ab73800880d046cc704a778d8aa436a7b
SHA2562d9c3e9ff8d15e509892966b86030c07a1e12fd30611ff6ec058fe6d5be5f577
SHA51287ab26d6f8d6a2cf720d4bb5cd197306bcb939eb9c789288996d7752893d0e8c957e1d79b6e4218c411d63b6ec5774066dae09d14f552c0f9b7da9c4a387c509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54330ae9aff7cc2ece082abb47546adc6
SHA11c09909d80e797753c37172c36c12d1bb4e66661
SHA25698b7251470d6aa779c88ed4ddf2b0f77480eb272ee38bf4e191dfda00755b204
SHA512d15d16cc23a2a4a942a26d7abec70bcc5f3b25de8b80a738feb4f0f14d4eb79870fd60a207bd61edc783c42b017843951419c2aea91688b0af507252f8da0221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da937eea67051e3bd3010fb463cb9627
SHA1fb0eed6bf24084014f0fc46604e821dee031aebc
SHA2562add3b0d6b0420f3994dd22b6ff6d155ae1938113cc3bac8ce76e2db49e6c0bb
SHA512fe228d56d6948e5da48dfd0446eaa98c20bad662a770c88f37e72cb6401c25489b7e01c12815a029837719cc51a12405a57f66352b687a03152dc6e38a398b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577112ce315e04e2c28c63ce3dec2243b
SHA145373905d5e88c06c13cb6b79f293fc74e2849ae
SHA2569e157530dc5e1246c99fca30bf10ebc3f0b06e2a9811c936486e7e9c8ea8e429
SHA512a7f51a5dd1d2405ac7791500e2ad4d9705342acf1fb815f407e790b0ba3da05fde12942d10c722810716c2e1dbe552c335d9e206b8e1cade9021fa692098f37a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d58840df14e9c7f806d6852f6aad6de8
SHA112626c89de5fb25b63afd6fb0efca53b9c29bbd4
SHA2565a817422e286fb32c9426b311beb9b9da40a635ea38e74a4864aa97d5f2a9c6a
SHA512f72ba389846c1940bb6827b480fe631b489933da26968c90a575f1cf30cc7209bdef5e7c6d2cb98434db324593bbaf88d0d84448d447fbf6e94ce84d75cca722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e389af14cb266b469850a93f97b499a
SHA1af7a77991a8a9a296148e44b54f227c63cd1f735
SHA256df0bcd2826ce13c70722cc3f7ac418ceec25d8a1df2f8a6df767ab5a4f2be7b2
SHA5127b186167bf4cff7288599000ea67c0b62f134a1e62432fc1186bc9ced3b7ed6e97f1804bbf2df7738a123a033129ab3b8b0be31397bd9bb3b2ca14e1ec93c3b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560340a19fbc892dc79bd9773cfdeb90e
SHA1a48ecfcd7a726c1228b0732d2bfd45dfa3886e61
SHA256d174192bef072f173eb2b6ceb76e252b19fb1e0a687e01f485779343c4ce723d
SHA512ebda5e75efebe73ec1e6e100b2bf6f3ba2f7a89a706daf69eb00848f942ee0adb4af48dac6befbd19be40e83a2d075112d6a61bc3ee73bdbdcfa6c071225bab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d38e6670d8835035d63bc7ed95ac535
SHA1dd82ab1e8d0e3d04d7b54185ee148e2af20723f9
SHA256f051394b163edd76c58f7e2370544878a5b63866c73723feb4620dac0a00e6b7
SHA51280db2e7c4c7542feb7e7b990260895814de7124d765c3d3a7a703aea4677c6a67726777217781f562998b0130527a33b47dd21f7e9459279cbd1e994f07b9105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5a78513b639308411fe782937b7c832
SHA15e25f23689a3c5db2e4e74b8ed0b4ea28758e816
SHA256a183c2dd3a27c3bb384665a07c6db318907ecab8764e4bdf13d904e4c2d702ab
SHA512b06018e360136304c23eff8814859557f2e261482fa76734c145816241288b6f106849d7e76d804e7c2a551e8ed281bce0a760d778a049b1a87604478c98ce1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522d80d85b05c01a096ac571fa3bc0268
SHA10d6192aeb7fafb2c7871d8fe38ff3b8cf223a53e
SHA256775d2623e4b5eadb899623d2af1519b09b34beb3a3de3265ea24fba3693aeb2a
SHA51283527ec16a377c134936974727966285a308c977c6e331990a20a655685ce8ef23c5f2deff54fae60d13938a2398a88750fdde6b00d225fd3036bf19a1f2428f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50717ca90a28616542b417201551bab8e
SHA17726c2a067c19c1ed0c215a2a950b943d0cde6b3
SHA256f73fca759d53cfb91821e5ca2a62d2525ee482c8e022af37766a4652928a886b
SHA512182ad939016a56ad29adcfe36fa1a54ac3e71be85832b7ca7a47608cce6f36e910343c74b971049e22ab7ecf2e8f1cc21abf8687967a18a2713cba8eb2713ed3
-
Filesize
282KB
MD5a092bf35052d0aa1e6f14571806ff55a
SHA133aba7167b395bae9b0123e355ca4a54ac47102f
SHA2564470e073e129de30217d8f6990c714494a8a6664aca8c884f66051ba0113e6c9
SHA512715f7f6a1d811f63bfa1b4b3c8ac86245e39d8e39a1f86146da847338aa77b815aee32e59a669bf015f99c8d16aacb14d50c7fa5da20bc42350a6ce5594d562f
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
689B
MD5c65e29e1aab07810c790bd47b4b1f2b2
SHA15ca72b74040512aa5eb8468dfad87da8146d9774
SHA25693b11c942911889f2b6e70b2bb8e80d0ed1b9648f009b798364721c11ddc901d
SHA51291e215b2cdd97f334172bca40b40724a83e3891799836a9b79726933816b921cd844a4078abad743d6773ed173ca24c71d865ae91f6a6e986750bcb2cbc02ef2
-
Filesize
5KB
MD55dd6c9b5f678a7f6bcc35d2d1c80c6b4
SHA125f3e802de291e5dd40e9fa6fb63a550bd6dc44b
SHA256d88a8c1ad8faefb873b967e179ff2fbba6d6ab3cbb10e1651fbf07d11395b16d
SHA51211d82e2762c2866ed95f6a7d1c356264e5ac5bf3feb4ea0ebd51cf0b8ca161c3636a9bbbcb0160ef31be536b140a250cd65c40f25933b6599557728074563a35
-
Filesize
5KB
MD581733d05ee712441af70f9562900c7f5
SHA1aba4fd5c1078d659de16458e0209dee77db7ccd4
SHA256d3c1552fbf042b3c9ed80bba974d47192f814b3a4779766fdca219643ab92966
SHA5125b5008f40150fa4776d19fc3af3c5e64c739914030a1631ab0509b6dbe0b48ead9ea84275a7d6b43b62fb62775d6adac43a1ef5c38d9fb8eced6fdf1300f7bb4
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
282KB
MD5ad3c673d86d49c9fba5d0dd0870c1f32
SHA1960fa8955e3ffb5197c2b7546749f81ef12120ae
SHA25686141df7f6e2bc26fb952447ac36af40b72bad5e971dc6ccb902992c9020af47
SHA512632f2dbc1cf917e7a402aaed950cb9735dedc20275d00db7c6dacd3cefe5f232a835ed73b87097b0a4e12d2fb0a016809274ad82b24eea1d60315f3c9f8b9e3c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b