Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
29s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
30/12/2024, 05:24
Static task
static1
General
-
Target
Aimbot MTA.zip
-
Size
1.1MB
-
MD5
daa57cdeeab30823f89e5349b832a817
-
SHA1
feb679856d7a4a04d5e1a26e741dd6deb5ee0e88
-
SHA256
129c9712c6553669392a034fc14842a4045df98bb8abce95a6b74ecf9760a4de
-
SHA512
1403f94c54374a91e8d9e29b594b490ff49c16b4bd404148157e7b2a7eb57beced3459e612045433e3b4a0f78aca93d34fe2f4c198fc5669dee85c139273f376
-
SSDEEP
24576:3bPC4RI32t9KyRPCKNJrYjWj1JkpsnWvWjI7mBPJiOMSeFAPNuHWE:rKsIm3K8voCApsnBnFJirjSU2E
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x0028000000046113-2.dat family_quasar behavioral1/memory/3544-5-0x0000000000120000-0x0000000000476000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 3544 Aimbot MTA.exe 2708 WindowsUpdate.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133800099246928379" chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2272 schtasks.exe 2812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4632 chrome.exe 4632 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2084 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeRestorePrivilege 2084 7zFM.exe Token: 35 2084 7zFM.exe Token: SeSecurityPrivilege 2084 7zFM.exe Token: SeDebugPrivilege 3544 Aimbot MTA.exe Token: SeDebugPrivilege 2708 WindowsUpdate.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe Token: SeShutdownPrivilege 4632 chrome.exe Token: SeCreatePagefilePrivilege 4632 chrome.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2084 7zFM.exe 2084 7zFM.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe 4632 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2708 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3544 wrote to memory of 2812 3544 Aimbot MTA.exe 92 PID 3544 wrote to memory of 2812 3544 Aimbot MTA.exe 92 PID 3544 wrote to memory of 2708 3544 Aimbot MTA.exe 94 PID 3544 wrote to memory of 2708 3544 Aimbot MTA.exe 94 PID 2708 wrote to memory of 2272 2708 WindowsUpdate.exe 95 PID 2708 wrote to memory of 2272 2708 WindowsUpdate.exe 95 PID 4632 wrote to memory of 3712 4632 chrome.exe 98 PID 4632 wrote to memory of 3712 4632 chrome.exe 98 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 4704 4632 chrome.exe 99 PID 4632 wrote to memory of 1972 4632 chrome.exe 100 PID 4632 wrote to memory of 1972 4632 chrome.exe 100 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 PID 4632 wrote to memory of 3416 4632 chrome.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Aimbot MTA.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2084
-
C:\Users\Admin\Desktop\Aimbot MTA.exe"C:\Users\Admin\Desktop\Aimbot MTA.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2812
-
-
C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2272
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffce6cccc40,0x7ffce6cccc4c,0x7ffce6cccc582⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1912 /prefetch:22⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2212 /prefetch:32⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2300 /prefetch:82⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4364,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4544 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5000,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5016 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5008 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4856 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4936,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5364,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4964 /prefetch:82⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5716,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5696 /prefetch:22⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5744,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:5300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4908,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:5752
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2320
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:1800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffce6cccc40,0x7ffce6cccc4c,0x7ffce6cccc582⤵PID:4460
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD567c7f4a90c6057d62f2eec78d9b60f9b
SHA1077ea200093ee1b5b258268b02f76bed331c3e1e
SHA2567ae47ce5ec2eae7cdde736d1b770864fa6e3b2b0e78507841272235e2d0dfe5d
SHA5127b7a8ba989f469f3d31616a635325d4e486c88e2878e18b423a8c94a2592d25fcb7a01a3aa7858b365ff6b582ecded320a9e24183b3b205620834859de7ef2a5
-
Filesize
649B
MD5d9e7161aaefc3888a63c191322461c1c
SHA1146a35ef22df506460b97d54e9545931ab04ae8d
SHA25687daf5bbdb74bdb0aa70959605f5b000cd35f66b010680ff2d221d93d4d1b7fe
SHA5127dbb5bcf86e2c2060d8e325ae550c3f4ad167485cbf1ebb8f8993c39da04a502ed26935aae5c7e279146ff37c03381b11b43f73dbf84b294fbe30bd31fbb8f65
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
686B
MD5efc7bd459b939754348bf423f21d8c5c
SHA15e46e304efb7a75f86e9f394b44d0542288a86c6
SHA256ebd072a36e9bed1ed280d6b147359edc317d2e91436a6f176fca7e71851c4a36
SHA5120f1fd004a1b816df9e7d5e4acb72c7c372dd520456a694d6bc6a7e9d744adbb15bc04ca8e92caa97c0f691560f9850b984c60c5848145e0d457cf5260134c999
-
Filesize
9KB
MD50d71b08f7e469e4fa73ab309e95333c8
SHA16b2d6bde6ccd2873ac60bee2cb123cf341101975
SHA256ffb31437c8d5d190b92a455204a4d3bd6ea357c8053766d4853545b0889061c2
SHA51260b487066b149cc26ac27679111cd63b4f3569f97e08b47397106e1d098c071b0d1b83883bafa337939817e6e01815d7d9bbf64e3e512b1a546226d64c7f9f6c
-
Filesize
15KB
MD542ec56cfef47c4fb70c8012847661007
SHA1c622c12ad94b19a182e769d31e9af45f69dc3b49
SHA256d248e29c45de9b93d123650c00c052037d3644738a6f39c91bfeaacba562f034
SHA512c4014faa9ba2e9abdbb20e07dcb03cc005c39aad7fac234ca24546b48e3bdbf4bec791268fecbd4af4cfade9c27a93473d1704c3d78d35f243e3e9ad0af91bdf
-
Filesize
233KB
MD5df894fe0e413e706e126583796e69784
SHA1b04d1795c84671964af371318c4e55fd960f1f57
SHA2560676545d260da8e7d87d7edb527a48a5686b4444776a57f6d4580c7256430f02
SHA512c3f5a4050c557657a10bb1a142f6bfee37ef3154eac354d8709d998c8ad6d47178deef67699d117407b09e07218ef17f576a8b97caf2bd8266ddd71070a6c25d
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
3.3MB
MD5232fbce8fc20397039e7115d6736c5f4
SHA1ec3f9e41474a0e2597c5aec4be25158ccd2d4c68
SHA256f9a036faaf0d8069cad71070e3327f2b6318e7026338c32eb46dc23c18ab1291
SHA512b00d44a3fc0685b917a50008d66efd44c697692a7f02b2bc18f3c325642a8bb94d5966bd66d21fa045aa24d02a88600b3b66122e3a3f6309b3854f6820bc41de