Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/12/2024, 00:18
241211-alx6gswnbx 1011/12/2024, 00:16
241211-akl2ts1ldr 311/12/2024, 00:14
241211-ajr7fswmd1 311/12/2024, 00:12
241211-ag75wswlhz 1004/09/2024, 14:53
240904-r9kzhasdqr 10Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2024, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
Resource
win7-20241023-en
General
-
Target
39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
-
Size
496KB
-
MD5
6285ae9a1953232716b7817c6bce1ba6
-
SHA1
8ea818cd4c61b6c53a5eea7f5ff19cdd9e60a8fb
-
SHA256
39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287
-
SHA512
2dbdebc96f92dfda7a146f3ade91af8b4ac66ab9dd9d51b5efb72a0b5cd789086b49cdb435e837a013d7a29e9a4a9c148ad5ece84e2129fad84c5944b9485581
-
SSDEEP
12288:fPVEdXo7/apwbQB6R751Hlie+XhTalWP6lTcNeH1ug2nMnMqDXWxbnN:3VKu/jbp3lihmUiKwHs
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1944842353:AAF4AUZAlM1Eseaom3hr9cg9ol6hzIat_qw/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/6068-505-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3996 set thread context of 6068 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 114 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133783499796430902" chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6048 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 388 chrome.exe 388 chrome.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 6068 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 6068 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 6068 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 804 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 804 taskmgr.exe Token: SeSystemProfilePrivilege 804 taskmgr.exe Token: SeCreateGlobalPrivilege 804 taskmgr.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeDebugPrivilege 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeDebugPrivilege 6068 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe Token: SeCreatePagefilePrivilege 388 chrome.exe Token: SeShutdownPrivilege 388 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 388 chrome.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe 804 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe 3996 39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 2980 388 chrome.exe 95 PID 388 wrote to memory of 2980 388 chrome.exe 95 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 4256 388 chrome.exe 96 PID 388 wrote to memory of 1828 388 chrome.exe 97 PID 388 wrote to memory of 1828 388 chrome.exe 97 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98 PID 388 wrote to memory of 4348 388 chrome.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3996 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aIsPxrpSE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp949A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6068
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:804
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd98bccc40,0x7ffd98bccc4c,0x7ffd98bccc582⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:32⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:82⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3432,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3700,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:12⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4760,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3516,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:82⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3484 /prefetch:82⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5096,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4576 /prefetch:82⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3408,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3484 /prefetch:82⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:82⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4896 /prefetch:82⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3192,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:22⤵PID:5408
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD52a6c140aeb3d8d8ec547ca903f10d8b9
SHA107151e6c47ca4318971f4a981296cb114c405834
SHA25645fddd958ddce8870d3fe26791ff99a2521dbb081d7e3e7919f8222d32f6a926
SHA5128e8a25ad4a38fe075fe0816e333bc75095ea9e687212bc61bb103a2fe3c0ee66dd9f7c366a4f2b73be66224035a553f3b8b03b0ac942fba3d7128ee04a9ff8f3
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
Filesize
216B
MD50526e22284272403ae6bd724db923c4a
SHA16fa9ca2947e7e78e88187d2171fa466152f316b4
SHA256ea05f0f02d0871e45839a909eee660cec4f2220a3f647f38fcd49a82d5890ee5
SHA512631031057dc5a78308ca5a26b59a2576b36f922fccd52377cc9eadd787c22ea3276a2a24f4e58a5c03a49cd2d3b4f915c574769d21e5be53427020345ef1992f
-
Filesize
216B
MD59898e1aac7830d68fb237c1714590bc9
SHA1b128de966170a7da354c0f73a166844497d40e30
SHA2567ea8c6e556cb9e3213b2ec55b171ca7088dd4122efddc39df24ca60fb9fcdda2
SHA51214aa6d935a6d04d105111029e4775938adff03b1fb9ce608534016914a21a624b4c7a54e8fe591492efe9996686bcabda6e8b596e25a27ab28916329c44d1e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2KB
MD5c6da6297e6200bfcd56d077c46e62746
SHA13ed4339a97b2c19bf67749813e17db3d34bb332f
SHA25661a8a0fd54bf30f40d4bd40ffa1b1a9e7c43822c2e220b6db907fb73cac069f1
SHA51276815dc7399ba9dc34f6e1137b8921aedfa8a9114259768234ae78c7543fd31e14ef96325fc7a2c43a15baffa364e6eeef3ac64a741c6b492fd89397b8192b8e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD505476f34616f94e6fd6d26bac4ecb5ea
SHA1110ed01e884668cfb2f017827930c3ad2daaa3d1
SHA25637229b19b65fada28095052368a386edb39467769b0679cfcec5e58fce65bc7c
SHA5125b1241f58bb28cdbee3ee05e54a60c7875b3abdfabb8c71f8a288ac69513b471315a6d30e74feae970a510cf76c0754fd568bd182b6d1f8e88264f8633331430
-
Filesize
9KB
MD5fe3f5b278bbcca078ed84c863c5f9a1e
SHA10b7921506fa0d8b85046d13461ec498c88072d50
SHA2561d41647ec62b50a9827b37b38e22df061873a8ba782ab43ac1578c8bf3a0b57a
SHA5125336ac78cf2905f01a1ae22c7ee67557ee4b75ef0874c514bd49fa6159b2f5b3e4e07a51e23b6653a8a8d1eda6c8989ee3308d7738670d008a04fa1a21d08679
-
Filesize
9KB
MD5a93570f79351cdf4be7660c11845ac17
SHA17a9f08311877d8e6e0a16e0a5920bf2848a9cce6
SHA2567a236c1d1d7d65318518a54330634f8816c6161ca0d1796fe9442703c6bf05c2
SHA512fed59844d37ff5815861247e603af08f1a66ba4645963d992fa1ce60c41b7e57ffd96b20eaee69a6dce15a8efc5ec3d56c9db83f6b8f2aa13d979cff5971209a
-
Filesize
9KB
MD55aed343aed400c415a5e1808e0f69ae1
SHA14d6fbdbbc5151be3bb71e7b8b6f7fc1b6a716e49
SHA256a814413e10305f83552ccabd3e86e4eb5c0c340b3c9a626cc82a3a1f4e0b2f5d
SHA5122a3b23d8e0fc4fb48f3c04600d60a526393c1d174512700ee830551ba1ed474e6ac316d6db0f31abc546f822c73fcbd0a185d8853cc9482fb9a8dbbd40ff0056
-
Filesize
9KB
MD5965ef1abdae9ebefc376945c12045f51
SHA1c07120fa5c074ba950f2eb63fccab8a4c90185b5
SHA256aa66520a5cfb1976f3f462fbcc5ced848bcc03c7e6e36b4c6cd45f75706036e3
SHA512f5a89cc208053a2ddd8cf3de0f7aa0c6ed78389bcae5203540789add7434b3e159dab2a25f3a3bf16b57389aef1fab50825a7da073131b0a62307abca5bbc2fd
-
Filesize
9KB
MD55e36fda9f384ca45365913941bedd426
SHA1999331a4883a3806e9543124a199af405a627bc3
SHA25645b3242a096a047ba86d95298b23198b7a4199c31c649323068f28613b52a478
SHA512481beca2acb87cc4226f68ed961cfe407042a24359ca50267d11dff3ac6db0259aa057ead3f5765e3c6ba91f574b5667f01fb8658e0775ff091538d2ed943cf1
-
Filesize
9KB
MD54f72b80df3d3f5c2fb3411feddcc6ab0
SHA1ff48a370714db3ef352629c943ecbc50262a1e22
SHA2567cf92cc48aced0981f4789f3acd0a92302173f9af54a848f76c5da95973e3725
SHA512ef76f4930aafd227616b48edbf8612702ca1733324b89125b26ed1f99c814d2983266264797965b9032d7934cbfa6f495a0d47f95eabe18f1046b0fa0d326515
-
Filesize
9KB
MD5de7a781c1ca9f1299293c26c0d2def55
SHA1b5f4a5afed6a879550d2fe72a4a7d0c74881c2f3
SHA25628e52b4159ce65ef0ec809b76ec0fce0526aae2d081f80822b4015d3e854dafc
SHA51253fb2f08e02bfbf2cc5cade10771b832a586d16fd1788fd2b4136b56e893d1aac33b4f75f6021183417ef078ab9eb9f032e47a508f4f996dd17d7c3bfd2d459e
-
Filesize
15KB
MD57b5a1b70b01321eeeee3930dee88182b
SHA121302841a5f3be29674dbd6940dfb85cf8869daa
SHA25654505559b05e1d3184197de2018aea699bc55b19f1527dc5db977edae849a16b
SHA512bb785742afd063a33c8b08934ee9603704e7270ab980a11cf1b39445c3ebc117b5d0c1162405f5cf7569ad14dc469ce092ecbed09602fb94319adce0757895c2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD55db266fb97ce7b0680192b933c2282fa
SHA1c0ea9f504faf4c452ed640961c30bd84cfdcc0bd
SHA256c469f9e8ac60b55a5fec376856945c2366b147119ca8d29faeb20e6e0b142cf9
SHA512b5f9904901055e2062b5360ff5cdffb1f99bffa5fe7c590707edc4bad9570a2c19622c593952d13110e46083bbc9ebe5cafa2eae7f2b95d1afd8f1027cfe5c9f
-
Filesize
230KB
MD543b904e5469293cd567a38854604f504
SHA1a09de921c0723e61e8cd05816e9fdfb2a9479885
SHA256de7a38934c9e619618c0936b3e8c5abe01d6cd58ea7cc68cf7b9fcc922aca509
SHA512ada0aaaae9359853755f2fc3ad0b3feab637968e32c5320bb186cc34f15ed2e04d97084e8e4dbbdf820f488e160874e6264d2aa1b3253ba1bce7efc9285da78f
-
Filesize
230KB
MD58a9646c9043251c089b2c568a7d21b7c
SHA106e11264d84b8356fb3dbad73e43e5faac352db6
SHA25651979960c7d613fb2b2241948cc5126cb7ed914b51d6e8145f4481d8229a8475
SHA5121aad4a8f9cd3ca929c289ecc93100c7350b167ec0cac0ec5f321b0b3b391bfae02485bb87d27e756360e0db8c126664742fb9cc2ba16f2a564abbf0529463977
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
135KB
MD53f6f93c3dccd4a91c4eb25c7f6feb1c1
SHA19b73f46adfa1f4464929b408407e73d4535c6827
SHA25619f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e
SHA512d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727