Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/09/2023, 11:40

230902-nswswscd6z 8

02/09/2023, 11:37

230902-nq6kbacd4w 1

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2023, 11:37

General

  • Target

    SocialClubChecker

  • Size

    177KB

  • MD5

    5e8fb35e53516c2317d0bdf29e3fc4b1

  • SHA1

    d5a3a3d1a40a42deb92fa7d0828476a0babe93d1

  • SHA256

    ebb594c347797beb7f75b9dc4991cd0878a49a11d7522b4351d47f03dc88bd9b

  • SHA512

    2b8a74d664b476eab9ce2afacbb58245a808c49dd7733e6fac3c3e1f62f95ae68fd0c8de5deb542b86ad28de24ed5f7c3a13bcc2e83e9fa5329c94830d3d37d1

  • SSDEEP

    3072:mTRgFlo/MDlxAXjwfd67XIm1rLFceyK7wPSb/b2kHjoTLjNyiDTIDuqJzeFhsVSE:mTRgFloTDuqJiLsVSgE2Sxxspm0nii8s

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SocialClubChecker
    1⤵
      PID:2656
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4356
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2172
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8866e9758,0x7ff8866e9768,0x7ff8866e9778
          2⤵
            PID:2964
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:2
            2⤵
              PID:4760
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:8
              2⤵
                PID:2064
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:8
                2⤵
                  PID:1732
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:1
                  2⤵
                    PID:1644
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:1
                    2⤵
                      PID:5036
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:1
                      2⤵
                        PID:784
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5112 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:8
                        2⤵
                          PID:4128
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:8
                          2⤵
                            PID:4396
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:8
                            2⤵
                              PID:1052
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5252 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:1
                              2⤵
                                PID:2612
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5340 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:1
                                2⤵
                                  PID:3380
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4644 --field-trial-handle=1764,i,797730556600096079,3421629676588950857,131072 /prefetch:1
                                  2⤵
                                    PID:3336
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:2612
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                    1⤵
                                    • Enumerates system info in registry
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:1388
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8865a46f8,0x7ff8865a4708,0x7ff8865a4718
                                      2⤵
                                        PID:2396
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                                        2⤵
                                          PID:3708
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4448
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
                                          2⤵
                                            PID:3792
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                            2⤵
                                              PID:4188
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                              2⤵
                                                PID:2108
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                                                2⤵
                                                  PID:2976
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                                                  2⤵
                                                    PID:4524
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
                                                    2⤵
                                                      PID:3496
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4132
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                                                      2⤵
                                                        PID:3380
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
                                                        2⤵
                                                          PID:1872
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
                                                          2⤵
                                                            PID:2916
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                                            2⤵
                                                              PID:840
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
                                                              2⤵
                                                                PID:4188
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                                                                2⤵
                                                                  PID:3528
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
                                                                  2⤵
                                                                    PID:3508
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6172 /prefetch:8
                                                                    2⤵
                                                                      PID:3860
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6200 /prefetch:8
                                                                      2⤵
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3672
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
                                                                      2⤵
                                                                        PID:2100
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:492
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                                                        2⤵
                                                                          PID:3604
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,2077096536982742504,9962766145332815209,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5796 /prefetch:8
                                                                          2⤵
                                                                            PID:2928
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:2528
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:4860
                                                                            • C:\Windows\system32\OpenWith.exe
                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3380
                                                                            • C:\Windows\system32\OpenWith.exe
                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4844
                                                                            • C:\Windows\system32\OpenWith.exe
                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2256
                                                                              • C:\Windows\system32\NOTEPAD.EXE
                                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_SocialClubChecker-main.zip\SocialClubChecker-main\README.md
                                                                                2⤵
                                                                                  PID:3300

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\85619480-676b-4123-a991-d42b4d6b8dbd.tmp

                                                                                Filesize

                                                                                2B

                                                                                MD5

                                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                                SHA1

                                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                SHA256

                                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                SHA512

                                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                10513303e307a31f5d93b011ac912d28

                                                                                SHA1

                                                                                38bbb118001a07018c4a6371d48f140ff95b3aa1

                                                                                SHA256

                                                                                24e61047316da0cb0ef59d5936729d06c34cb50cfc059e278745dfb569d9e0f0

                                                                                SHA512

                                                                                b732c760a52bcd834455daafcf4ab3ebbd18f89458a0d2018fe68f51588f22d17e9e3652ef9f3d5d1dfcaba1475e290eecafb3096e70b62f55cf330f62a868c6

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                c503039de57870f457d7dbd3cfc4fe3f

                                                                                SHA1

                                                                                c892bf78299727be2c172bf8fd6e575f4bf25e13

                                                                                SHA256

                                                                                15214c9ee26ce21de761a6abc82434c475f58ac9bcb59e25da17429dd37dfff4

                                                                                SHA512

                                                                                b9294ae30c619e3a12d47927ffd330a04b06473c571fafa37b0c22992a67973f201434967af70c348386aea9c482082ef14e831bca6f7dac53ce380d4807a0dc

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                7bda362a3d7a3412aa46428f2342b6ca

                                                                                SHA1

                                                                                a2e917866abf3498153e10d70ad69e2f94c8c2a8

                                                                                SHA256

                                                                                1e38e8b4d94e584bbba92e810d68213c3cec18ee5ea986ac8582dbdae4f2d7d3

                                                                                SHA512

                                                                                3b12675a2056e1d4ae39754827437e30952cdf20be55b86e5df478423b24399ddc5db73cc9c48e1da50779724805f95878bf615c3ad75dfd618fa51b36dddf7d

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                Filesize

                                                                                15KB

                                                                                MD5

                                                                                e5d60d1152a9796c1d4c17b5c1153426

                                                                                SHA1

                                                                                73806e015a8308cad3d931b6d235954c5f51411a

                                                                                SHA256

                                                                                926ec3729433f6033b30aa84a7db2e3339804879a77cd6beb20f6a5c668f86f6

                                                                                SHA512

                                                                                f7bcaec1fb6069dbb67d6f5ea63230d6abc4080e502324d52ad8a6a4fc3993d4aee344f7114c62af8d311dc3d5f2a0aa1fe6c08bd3b4a258b9c41187596311dc

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                Filesize

                                                                                190KB

                                                                                MD5

                                                                                a3277e66f11f41c8a81597a00fe7a45d

                                                                                SHA1

                                                                                f933b5eeb6560d76f21cf6ac227ed8b927e38da7

                                                                                SHA256

                                                                                f7e3e69ae5904a69c7bbf918123d879cdf85ed99b72d48233b54f2725cd3d0eb

                                                                                SHA512

                                                                                8f8a79919caa29cab62f7d348d284fcf19a43c020fdf9eb3b4862a77859f0521b921fe05e24daab4b9917e0c8231e88d8536d87dd617a1e41920dfb084e7719b

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                Filesize

                                                                                190KB

                                                                                MD5

                                                                                db66adbe280a03cc46f5f935ff1751c7

                                                                                SHA1

                                                                                2348e67b92374de697a60dd29146acfe10cd3d88

                                                                                SHA256

                                                                                7c7617df18d72a3a4a989bd1f7604c3f416b698fa5f245ddb7a1cafdb73d49aa

                                                                                SHA512

                                                                                1d0e662de68dd75b26e1fcfa578b29f54a46dbacb62afcef54b9f3ef8b74d35c363de626f8a73440b082c5cff3bebb2d763c6d637bd0d933e7f18078522a548f

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                                                Filesize

                                                                                264KB

                                                                                MD5

                                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                                SHA1

                                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                SHA256

                                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                SHA512

                                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                Filesize

                                                                                152B

                                                                                MD5

                                                                                048656f46cbeec431fc9211b492b0210

                                                                                SHA1

                                                                                472e28d665f77507f42fd6d4373d69efe4817fb6

                                                                                SHA256

                                                                                b70bedb089a51bc48a6d94fdc9a44db7310d8ab1d5f17c0592e438a42efff050

                                                                                SHA512

                                                                                ab8a2e36fb6fa2afb017f26c1e15249f4d76ae7fef0a5c6142d50b11072242d2fc74bec1ee0c7973a4ec3b3109c3e26a7b48b778343208644dcf806b74572c2c

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                f7d0d64e04a70b5bfb74d02bc7592261

                                                                                SHA1

                                                                                df6c80413795e189fffb0b1a1a2ddd4126a0c057

                                                                                SHA256

                                                                                0f46ea60506150a7ba8c6e007ad03df57adeb595d0e40fd1e0c85aff4a71266b

                                                                                SHA512

                                                                                ab2974164cab97802b8a8e9280cd9de564a1840a03d9550cb99b581e11dec3ed83d91d0fc67872c4ee40aa3c99362136aac84f74ad8f64a78d9a7d432464fefa

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                Filesize

                                                                                111B

                                                                                MD5

                                                                                285252a2f6327d41eab203dc2f402c67

                                                                                SHA1

                                                                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                SHA256

                                                                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                SHA512

                                                                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                Filesize

                                                                                783B

                                                                                MD5

                                                                                cf545651a13db47261802884e5c8d20d

                                                                                SHA1

                                                                                21aea41a3ebc15897654041ca8ca65bec6eb5b4c

                                                                                SHA256

                                                                                379b5351ec5bd7f03e9e7eb9f8b93cebf07fcc456a38df78b6817c592fc0020e

                                                                                SHA512

                                                                                36f540399be28c6947f572aaa0ef6fed0401121f54fe1a60dc0a7d612f8ea28b17728e2cc9751cb5d164f41948d7de1f804aee67a180c6587529cd79bedb9386

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                42f03e73650553b3116e345669afe0bd

                                                                                SHA1

                                                                                7747d4243b2e58a7bca2da8c2a20661fb84b738e

                                                                                SHA256

                                                                                50bd78d65bf19408511d22551057d56759a842d15383119d49f89502994bf109

                                                                                SHA512

                                                                                ecc28154f805d46f384576e0e36b7295f40670bda69458d89f8d44e8575a50afc623969112b3b31de6bcad3f0046d0b9b4850fb6e97c9cf9e23b2d80e71db8a8

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                24ded7a19a4340dd575c3076d3dff9bb

                                                                                SHA1

                                                                                8ee4f3853f7d00a65cddbca37a74fd8d4e5e3f91

                                                                                SHA256

                                                                                767cc5fbcbf42ef1af85082a5d789110b2d0a97e200d70650ba3f8462484a7c5

                                                                                SHA512

                                                                                2b58da0d59a9401af5ce732bd3a444078c497f445019dd0bb6ad2161b259c082da46f6482acea59bcdff4614728dcc6a414ba1bc271c3ae5a5338e6b2ff12575

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                609a143c6df93e95906693cbb7f86c18

                                                                                SHA1

                                                                                71c49c3f7f2b7b819bd2faa9daee91ea876f6e83

                                                                                SHA256

                                                                                beb401acda73407fb9289544d8e304af464536fe330b844d4d1e805367bc5e86

                                                                                SHA512

                                                                                28ba20701d5770ab865e69f36ba24b1bae3482bee7a52c0947d726e3b03e7bb60e0fa7bb13a7e3d486f30256e77f7e378d16b64576e895dd4014d29780247c04

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                b68f1f76f09899e706222ceff3875328

                                                                                SHA1

                                                                                9f31810229ccc5c9d8e5a812a27f6105afba89f4

                                                                                SHA256

                                                                                a7f26a26c0092a03753f6c485345d884bcf421575965fb9b88f53a58c135060f

                                                                                SHA512

                                                                                bc812323836a89ba5611e7402f91fffa87f5880b462dccdbbabd9218205d37d48e4573a11d12cf8026f83324d2124c4e90d4a7dfebd93d57cf87f0a826767ff1

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                Filesize

                                                                                24KB

                                                                                MD5

                                                                                b2cf4d0049ace39b74eef79a55294004

                                                                                SHA1

                                                                                d7c3ca52a379d2e60352e30270360f961bbb2ec0

                                                                                SHA256

                                                                                f09ecec25a5a6280529f91f243579b90dff160b1432b685455031fd1dc4c4f6f

                                                                                SHA512

                                                                                75dbba4e152552da37f9f7b5b8655c7034c070db3bdbc3c4ec20bc5e509c420df86f6f5ef0126ca21b3eb73fee1ca93d1b555896a51a95e806655de491dcbc16

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                cdc7fa04501da648728d04a014776b42

                                                                                SHA1

                                                                                b94144cf402813972eaeae4c93cd3229a7aa7add

                                                                                SHA256

                                                                                5009d28108367d0b480261ea52fbbadc00a90e60ef679ad312b2cb833f318a26

                                                                                SHA512

                                                                                5d1427e4b407c57b3d8c0b9d29f441c5601293ef7b7a98f1b6ef0281bb49f2e6cecaf036769e560ae3d72af0368286184ff2aa074bbc11f09ac9a4314ecdf1e1

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590565.TMP

                                                                                Filesize

                                                                                705B

                                                                                MD5

                                                                                388cea79a5c94b62c8ceb388a960b9dc

                                                                                SHA1

                                                                                6f9008a192886323e16dd808b3573c86749bc20f

                                                                                SHA256

                                                                                036d81ecd7ff8c850b2bba324d14052e833c06a245295f2b6771f268b9aca7ab

                                                                                SHA512

                                                                                eaf879bda7d642ef2cb238a733a951503724359e70747a2a11ace7111a9d2b38b2ee81716efaf0257541ea55f616b7c964579477ad9f8b5b6705f7047766dfbf

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                Filesize

                                                                                16B

                                                                                MD5

                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                SHA1

                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                SHA256

                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                SHA512

                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                c7aa1dc4d9d878653f0dea1c388cb832

                                                                                SHA1

                                                                                1e7441f2ee3a7095da6fb1cc564c13a31a2c0ca3

                                                                                SHA256

                                                                                ef67c5053e81e3b568619991da9bd2ab76e5f0ebbd08dbd1ce545f965b656969

                                                                                SHA512

                                                                                ef55f256865551bbfec3c290267869fb387e9863b877e405bb990d94ea8e94aae00aef757518247921de2a683f503174b0aaf12a5b62e9137269d4f875cbe8fb

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                a87deabee58e3ab88cef8516d16ca3e8

                                                                                SHA1

                                                                                233dd56f27ed3067bae9b1ae480836c11aab12af

                                                                                SHA256

                                                                                eb74dd1fbf99baa83dddb643edf5a181fc63f4c12ed302f7d52835019a561f38

                                                                                SHA512

                                                                                c1c6aed68b77b0a1b253cbde0af9beaa114bd2a8a70555d8d967bac4c1acfedfc4869c291d2408ffd14e88a056ded2aea3d623e29c60415e8015d73c23adc551

                                                                              • C:\Users\Admin\Downloads\SocialClubChecker-main.zip

                                                                                Filesize

                                                                                600B

                                                                                MD5

                                                                                3ba8199e3be9353ecf388a71c0f71a20

                                                                                SHA1

                                                                                274bb2c25e9f3c27b6609bfdd50a7cc597079e55

                                                                                SHA256

                                                                                145f028ba6882b9c5e744969c1384587cd8347b4964428a0144666c70d562064

                                                                                SHA512

                                                                                782454bebfa40c0788e0b49a5b48e86e5a0f055bca875369a87ccb781a33369186463919fbfcdde11d297f5a8e8c07355c0f0b97699776da2f74f5da718b4c2c