Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
80s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
Q5SIXP.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Q5SIXP.html
Resource
win10v2004-20241007-en
General
-
Target
Q5SIXP.html
-
Size
8KB
-
MD5
e13de7c2d6e3f13e4d464b22b94701ee
-
SHA1
7b2e056d6e20934579667b88863583dbc34c6057
-
SHA256
234bbac01c5816fe5e8061b97068910f672e2f90178d7cb8e0322ad77668328b
-
SHA512
033850edca61c0b2b0090f1c7b3688eb8da74f961b920fb229929dcf42e96b7c56b31c80237cddf39b5d03b2fda254326cab1d75ed7ff354f0a603a2e2595e39
-
SSDEEP
192:PN2x2BbocMt2bp7owoaGx++kBRSMlBLZdt0epiuq29eV2TJ8T9SUYiySTN:Ax8ocM27ET++kBYqPD0n1Vch/cTN
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc4c610220b15a4494a6d3475328eeff000000000200000000001066000000010000200000008f9b439ed38ebb2ae1ddf38454f6f0de259e9b282ef394f4832465a654e06ad9000000000e80000000020000200000000f20be5335ca58edc2440e3563868330d9299c759a46013d82a75caea6fb5e322000000031d4814beea0b8e2574390e481196f64550b85ddb966067f9e7ee6a77300cdec400000006544fc92fe4acdb8522a6f9927eba6581f0d107cc12d1a3b2b2093dc0bff123181f357fcb6ac90906428901fb65d5a2efd7e64eefe4224291f7856bef4fab98f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7092377ecc20db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc4c610220b15a4494a6d3475328eeff00000000020000000000106600000001000020000000e272486e9eade61e90feba6b09fa06201e7099ad770d8979ccdb0dffce968e04000000000e800000000200002000000065aa5f2714fa384bbe497d767fd2cb5208749f2072baac36bce905b69e92711c90000000e2ee23e1257b970e38a3c3b7ecdedea173ac2c81eba79c7982447b59f99a2bf108b5c47b45e6e2b46df34ad9b7780bbf55974ee1dc4cc7d6656ea28aa745fb5ea71d29e6893b43ff1dcbc20eafd087986c332703c4c879dd0e4d71d219ae541342475ad89611b9cf34a258c476d8cdb3ea022358c76f777786ff4648ebd37b4eaaaccf296edc5a4cd450790449f60fcc40000000c93ac2b8ad1a82ecd115e47bdcbbf86969ab3caf57d76ed627559331de2b82c8c3f4b793ec849dbf5d4317fb48c304b490c449094ea5411e1160f2124d6a92e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9AB78E1-8CBF-11EF-946E-F64010A3169C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435355896" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe Token: SeShutdownPrivilege 2180 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1080 iexplore.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1080 iexplore.exe 1080 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 3000 1080 iexplore.exe 30 PID 1080 wrote to memory of 3000 1080 iexplore.exe 30 PID 1080 wrote to memory of 3000 1080 iexplore.exe 30 PID 1080 wrote to memory of 3000 1080 iexplore.exe 30 PID 2180 wrote to memory of 2636 2180 chrome.exe 33 PID 2180 wrote to memory of 2636 2180 chrome.exe 33 PID 2180 wrote to memory of 2636 2180 chrome.exe 33 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2856 2180 chrome.exe 35 PID 2180 wrote to memory of 2212 2180 chrome.exe 36 PID 2180 wrote to memory of 2212 2180 chrome.exe 36 PID 2180 wrote to memory of 2212 2180 chrome.exe 36 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37 PID 2180 wrote to memory of 2216 2180 chrome.exe 37
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Q5SIXP.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7cf9758,0x7fef7cf9768,0x7fef7cf97782⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:22⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:82⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:82⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3232 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:22⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2232 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3276 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:82⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3560 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:82⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:82⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3636 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2280 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3840 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2352 --field-trial-handle=1284,i,15094203331973711749,16483868666908693968,131072 /prefetch:12⤵PID:916
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587333fe00d0b4a917b13f14e42c7aca8
SHA16734792d913e8206f9c141a314d733d0a7aba404
SHA2562617d5e300f515974b5e0aaff2b4c80a1c1a50f29858ec8f68a1119931182db0
SHA51222cdbb7255d500d5ccf12ebdb89d97b057ad67529a1486b4055c9433bbc7fabf85de01ed9aa6e5b7982034c1a33742cf336ffa7196e12765062f3a25d45c7bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537d391e5ff7f30cf581cf6609d9cb514
SHA191319830ea8deb1f3c23c6c3902e968e825f9f9c
SHA2561964859f0d0e04b4c15004cd751a59ceabd0639a73db3184121afe95fd251210
SHA512e2e0b448108228fd1994a5e6dae9a5ee22688cdf7df1d729eaebba4e961e6d25bc79d6067e133aeaab4ccdd5a45bdce52bbaed861a4573e8e4f30e698be97e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff0afea5d1ed126606035ea4d21dddf8
SHA1bc7b24f6e30ead3cd729a1839305241466380b41
SHA25654ca9c634f46866fd5e1138cf2cecb3ea6c3ab4bf6383428a07d9f4b3e18fe9f
SHA5122d9461572299f56eef3bff12bd3b9388e5b7e36bb9678ae9d497699a759bdce773b72fe13853d542bbc4b9f5a9aa184fe8b742a520c30e3a6e0253dde9f15d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f3e0f95aeb440c4328bb3fecfc26810
SHA1198510b45673729d0884904e5d93e1b2d1666f5e
SHA256f7ccc90cc832484ce21a0ba4717e6ffc0368bd3739946e877fe5a720d126a087
SHA512de9ff02bf3adb503c0427660b718fec1316f30f4a148976adac9ef558519adeda113e3e1c631ba97c7474bee6385644abb5b8dcacd0824f8dad0867b8c0b1a02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5440a577aefd7727d2a5b13d88667fafa
SHA1fdfbde136e7de3f9a69d23999acca3bce1394633
SHA2564101ece9981fc26d6310bddc6671368d0fb26931606365e65bbc617504cb6e01
SHA5124dff623b5d0b948918753228075c00c5e837fbd67f45aa961fb2644fbea210e696fff921798a70d813870a7881f87b931c98a6c8fe9ceb56373fd4b041b4430b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ec5b33108a24eb4f04b235b68802d52
SHA18c9d8c7cb3b55ccb44344ae11ecd99b00d3c9ccd
SHA256c89ee8ba6e3cf43b00554edb5cc82d912853dc9b8601b167840d158644141a19
SHA5125e73f83a5c108f86aa9f2411b4a20e16b998bb06843ff9e825a692d001a1591ca4223bad74821673b4e9eb3cbc507c33f2cd7d68bf011525bf9aa274b102972a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5301f0cd40d940ee341805df110f48f4b
SHA1df04574983a17ba1034f2d6eee090152eb40a707
SHA256d2be1973368cab32e9cbfaa2279f6083382021b911e8256c800b63fb9ae74339
SHA512d13a349fb1051bd365b9b1b74be55501154b42e1d51d1fb504d59c647358f68d79bb7edb006e42805c20dc112917959fed85c66f7d061cf38d00f32c4095b9f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc9715e45aeb68a34f9c9f821962230d
SHA1c9fab05cff3b0c1bda51f0b50135ce292bc9e361
SHA25674070c6bc82fe32217445ff4a5873e405125b500733e0c65df006d43798edb96
SHA5127ae3033e4715344ae24f83adfd2fd81cf61dd8c5102e13340e4d85231b900bd489f98e359f245e45354b3020d15dda5efb8c0cb2e0c4acccaecbe5268cfe8049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58db0026677041f9dcd714107a3a11498
SHA193923e3367b65af07fdec3bcaf02dca02b8560c0
SHA256df294da11ffe0acd3da7b642676d6278a512ff6462dc35957cb5482902506410
SHA5120d2cc518cb37add1930a618a6b6a01626cc9264f7098070caf65d35b04974d4e74ce21388d90db6db7ba52edf3ae48c27794207f04fa1a49db11303ac227114a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea7fe4131e0c84d3989ec3c490bb13d4
SHA11468305b5b53f5f2d5fbc52e9046a27a6957fc70
SHA256d884f957914a092d2021a3ceed069a2c32620d935d30b772f433234de0a0cc86
SHA512ab58d44d692fc88910dc0660d8288e60062866593252127129dc2a370a1eed2912502e54c252175221101217cf340548ba769821c6e975a3b1ae33edcff1c3da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc88e12928ddff23c33821de7c800229
SHA118b5cc42686f03737b2ae87f0b8651a97cb86077
SHA256fc8b70b36960f1a0477363d5265df0145019df0913d7bef0ecb087d52a5d7bc5
SHA512192f4b26fa6774f80360e7a9d4044bb2fc5ad2cba042af96f80a1275cd418ca1a2fdd3dd4ab96243d7c0c204bd566fbcaac41515ddd421973804138206d54620
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51568e00d69402227b52ca5a75c489573
SHA14c887e067899218914e7001c12a96b0d1bb91bcc
SHA25699bdcd12e2147e2530c79cabfe26773a9bc49ae59f074f7663eca2eb97d2a54d
SHA512da1cb5d27bdebef793a37c6957b3342f1b3c8bcfc54654a31c8db49cdeec52d41fb87bb1973d5e095ba306f95c231c6a261830bdce58d20a700ce7a3629cc13e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6d920766abd741e9681114b7547c1ad
SHA1f23debafd20c9d8bb9239c4b607cb857548ebf8d
SHA2564c548e34bf2e7062548678706863b5fc9792d1cae3fed83cbcff52bf1a34b8d3
SHA512827bbcf718aea6ba2addc65a7f34605a7cd1772a138c56ba4b7e4f188a69c757035b08d6c1907535e8167183bf68d020a5bba9c9f50fa12600619cac6091804f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528e9fb440e5dff94adec993a680c6a0f
SHA16e023514d328a83515b741fd7c3748bb11c5d964
SHA256f011c8c0e9ab3c32d9177bd4f29e04e1a568d4862e8c43aed5b97f39aa2d68ab
SHA512ebbd5a9b725305aa9b1ac3bea877f4fd747f58b367ca8dcd068483958f8b3ddec1598876d9e6d60fa0822023db43bb9823b76961abb7f6ca8e315c972bc4245e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4519f540e1d21a944ca3e36e969da56
SHA1eb414cdc8199c5e4cf389a0e98bee96a20464a58
SHA2564493c129fbfb0b30b2bf34dbafa1fa2434b4f0ba85542d7512e249a89f688d01
SHA51236fb37295e4b1cccff58b8cc3da36149e56ce773c9ee2ddfd9f4f56d7174c8a949f6d6057780ce33584da20978876e4cfb18370cda0c468dc7c7111bf74bac6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9aeac1a682260b1feaf19f8677af800
SHA1a2515ab728602b2b0d0801980622ec56526521e8
SHA256bdcf1dd71d6d721bbde993e64148bfe567e0f22a2fe98bcbc0742f727f791bb4
SHA512d354f15abc222c5dd088b2e60a932f8c8b5c5cc62e10a12aa4a087adfd265a6f6fce9c7758018aee71892bf8a9ab124d4bed5f80f237873b01fb01ec54b3b20d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54283a9ab28cbaa0bc3db14600863cf92
SHA1fa3f2260c7c6b2c203007c8d5b9ec2478788ac5e
SHA256f7e9700c52b4bf8e3c0b503aa5d7c2f70bfbbed46165942ca520d4b81099f8d8
SHA512dde7c43f6ee4c18d9f8c8364304e79b28cb89b80252d0473eae2fb0f3679998b9e923f332fedeac9c6a329fdbc236291f8ffa43e52768702b5e769eff8b0ebc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b979e30eda548d0f10fd7d9b3e47dd6
SHA15978a4b3e3ef8377fdde3d4be6f5302eb215248d
SHA256d6f06840f950028082c917c4e33ba813e182ea7e5e2a042f4fad141c1b5b514c
SHA512669188ef228a8ccd7bb92c9518c2c37ed8557600045af060303334263b55e2544a85ec61ed2e920febe7019d06b44e66c33d4f312bb7408fcb831a573ddb2965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eccc65e8ed32015bc96b0d35bda861a6
SHA1036118f796b0da646eafb8d56cbf445e10eb1e2c
SHA256cefa432cc622fb8c25d4ad36a2924e94afade7c3b108e62f3701c586d4817696
SHA51201b58f281181bb45ad86c7f98ca3a237552fdce7a5bb129e6562ac5833e8c852c4c258aa0df0249b1afc7765ad068c31595504bbc670849bbd93a01aba4b2d7e
-
Filesize
328KB
MD56e0a853d0513a0ef582325fbb66f02af
SHA143db15b6d44f02adebae71148adf11c17450df6e
SHA256da3de5df5393775a663d096f04bc3aa6fd617735510f8161b68b8a0c3a6f0f27
SHA5127a4af7b118c58ff3892931a3a158d425f376d81da143aa1f3076c63e6e11e2527a56494d115bcc92d254b6a44358e740e4b8c22a8fd10b74950a4acc07d0e7d6
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5c76d6751b0788cedd9ba60d8bbeab11c
SHA1d0c7ec02120cc3cba79998bc4c617a78250a3008
SHA256c6542287b9c85b18d8500163811efe5515661840dfe6b69e6d648c7d42a6943e
SHA512da1aef49a07bfde33769bfb0185c9354d7005e1cc10f2e852d2eedf7a6620c86febd97fa65e7c3fbf96571920e37cf3e3e9f37fcb5e0bd500f966c0da990abab
-
Filesize
5KB
MD558780d7bcaa3f8cb229dc42f6c281277
SHA1b25d51bb916bd1df83e981211dd5c9bdd0333417
SHA256f12a5722dfaaae7c1e5177f617e97e575c2c918c1227f0d4a6527f2ab8e3f092
SHA5127f6cc6360c645fe5d686f3fca0ceed3658cd1f328537913d6d4813a92ee369aca3a1ca4597740001e1b01be01d5d1712aa974425da6c3bebe6438b2856e9006b
-
Filesize
5KB
MD5b1704e51acb3ae72eba5ff5aab560a61
SHA14f0fd91f8bc6398a1923659b2efdd14730abde84
SHA25616829bd270d9bb56c60d3a4eddeba0081909cc048fc22de8e4baabc6d4507c24
SHA51248ac74d9bdf67a6260244c454dfecb9beaf831c67a8c8ea802274687bc5de3784e41ddee8cb17e967cbdeca604e1c6b036ba0d675347d035de7c1936a266ccf0
-
Filesize
5KB
MD598f2ecfce686848a0c7cc85859c68b12
SHA15bd745a9309712d1627f64cd9ee546a29c847217
SHA25639312fc298296ec21c7bd3130b2f0e1c2833dbd8bb578862bf138813940faa51
SHA512ddab33b0b0beb2952f1b6cc7b2c39722d7f00663c7ba3aaa1e5ff0ccc98c0dc92e0b184ce1695fb5d11a7ef7dd9dc0c2b26c33bc17f3e417986b4ea4536e31e7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
328KB
MD5b1fabea7d13cb55ca414741e4260a707
SHA14396359ca445a89af4c10b6e6ca6f844aad49e1e
SHA256b740f1ac124bf73559bf9fe2329dbfefaa5eaaf3b100476802bd9d8240f7d3af
SHA512380934ac3c115c1b629b1b16aa5145f24f9058613ff62a40e6e8a1679c9e9157ed249e32856c97421ada2e132655e72f1529476fa54a45c1d171dca9600b8c32
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b