Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XWorm V5.6.rar
windows7-x64
3XWorm V5.6.rar
windows10-2004-x64
1XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...es.vbs
windows7-x64
1XWorm V5.6...es.vbs
windows10-2004-x64
1XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3XWorm V5.6...ources
windows7-x64
3XWorm V5.6...ources
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 22:10
Behavioral task
behavioral1
Sample
XWorm V5.6.rar
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
XWorm V5.6.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
XWorm V5.6/RES/XWorm.MBox.resources
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
XWorm V5.6/RES/XWorm.MBox.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
XWorm V5.6/RES/XWorm.MIC.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
XWorm V5.6/RES/XWorm.MIC.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
XWorm V5.6/RES/XWorm.Main.resources
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
XWorm V5.6/RES/XWorm.Main.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
XWorm V5.6/RES/XWorm.Maps.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
XWorm V5.6/RES/XWorm.Maps.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
XWorm V5.6/RES/XWorm.Performance.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
XWorm V5.6/RES/XWorm.Performance.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
XWorm V5.6/RES/XWorm.Port.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
XWorm V5.6/RES/XWorm.Port.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
XWorm V5.6/RES/XWorm.ProcessV.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
XWorm V5.6/RES/XWorm.ProcessV.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
XWorm V5.6/RES/XWorm.Programs.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
XWorm V5.6/RES/XWorm.Programs.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
XWorm V5.6/RES/XWorm.Proxy.resources
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
XWorm V5.6/RES/XWorm.Proxy.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
XWorm V5.6/RES/XWorm.Ransomware.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
XWorm V5.6/RES/XWorm.Ransomware.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
XWorm V5.6/RES/XWorm.Registry.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
XWorm V5.6/RES/XWorm.Registry.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
XWorm V5.6/RES/XWorm.Resources.vbs
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral28
Sample
XWorm V5.6/RES/XWorm.Resources.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
XWorm V5.6/RES/XWorm.RunPE.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
XWorm V5.6/RES/XWorm.RunPE.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
XWorm V5.6/RES/XWorm.ServiceManager.resources
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
XWorm V5.6/RES/XWorm.ServiceManager.resources
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
XWorm V5.6.rar
-
Size
20.9MB
-
MD5
c4a971e4db488afd8b8a4c3946a2f726
-
SHA1
0e5d39de2ff550deff505bb6230d2a84b4285e7c
-
SHA256
95836339b5940c5470c1362edf291941507adaf6a59bb1827b054cd85ca753b8
-
SHA512
d6ec0af5f6c9dd82ef6a4e1d24c11f84bd7191aa709171e60c621272a5f7a44f5fce1e78d4a3a7818acaca2706adf09fec07b0ae151ecc055f9d6056acb532dc
-
SSDEEP
393216:KV08kfP8p7e6Db/IPipIxzoBJYFB7SiEfJPBA+XVGVr45yxRxmduoM7:KG8QP8p7bjzAzoBJ07SiEfnxlk85ytCi
Malware Config
Signatures
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2620 chrome.exe 2620 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2808 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 2808 7zFM.exe Token: 35 2808 7zFM.exe Token: SeSecurityPrivilege 2808 7zFM.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 2808 7zFM.exe 2808 7zFM.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2544 osk.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe 2544 osk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2640 2620 chrome.exe 32 PID 2620 wrote to memory of 2640 2620 chrome.exe 32 PID 2620 wrote to memory of 2640 2620 chrome.exe 32 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 2596 2620 chrome.exe 34 PID 2620 wrote to memory of 564 2620 chrome.exe 35 PID 2620 wrote to memory of 564 2620 chrome.exe 35 PID 2620 wrote to memory of 564 2620 chrome.exe 35 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36 PID 2620 wrote to memory of 880 2620 chrome.exe 36
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7879758,0x7fef7879768,0x7fef78797782⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:22⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:82⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:82⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:12⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:12⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:22⤵PID:284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3220 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:12⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2884
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fa97688,0x13fa97698,0x13fa976a83⤵PID:924
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:82⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3736 --field-trial-handle=1364,i,3583252262906232978,15879880551261126841,131072 /prefetch:12⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1640
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵PID:624
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵PID:380
-
C:\Windows\System32\osk.exe"C:\Windows\System32\osk.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
346KB
MD5348391476ea54ce980a84bdd7257c9c6
SHA1f5562d63d98e3b21e63f3694d6e954e5418a3083
SHA2566da402624179d1ef42193279a6eb9b36e50932d7fe66c4c152fdb64ada26c3a3
SHA512a168b594fbc3b6a510abaccf887f8dad5fa2603a13458f8679609e2e43d214a6de413ef441933e7a6d6614d371bd1cde848437cc77897d4bc31e1073eb926d32