2510be907ec476e8375ac7b5431536ae9a32bf99fe77ab695a5100852b111b96

Analysis

max time kernel
71s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraB/Solara/SolaraBootstrapper.exe
Size

13KB
MD5

6557bd5240397f026e675afb78544a26
SHA1

839e683bf68703d373b6eac246f19386bb181713
SHA256

a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239
SHA512

f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97
SSDEEP

192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SolaraBootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1288	SolaraBootstrapper.exe
1288	SolaraBootstrapper.exe
1660	chrome.exe
1660	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	SolaraBootstrapper.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe
Token: SeShutdownPrivilege	1660	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe
1660	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1948	1660	chrome.exe	35
PID 1660 wrote to memory of 1948	1660	chrome.exe	35
PID 1660 wrote to memory of 1948	1660	chrome.exe	35
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1740	1660	chrome.exe	37
PID 1660 wrote to memory of 1916	1660	chrome.exe	38
PID 1660 wrote to memory of 1916	1660	chrome.exe	38
PID 1660 wrote to memory of 1916	1660	chrome.exe	38
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39
PID 1660 wrote to memory of 2916	1660	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\SolaraBootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4d09758,0x7fef4d09768,0x7fef4d09778
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1540 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1500 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1996 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:2
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3736 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3400 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3808 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3844 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3736 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1352 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3848 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2696 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3896 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1844 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=1384,i,2173119688931139273,5750188603781586758,131072 /prefetch:8
  2⤵
  PID:1844

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e80dc696fec76d32dd19e2cfc1568a0e

SHA1
97fe6f484b4b92a461b2a143d029afbd03ab377b

SHA256
0c901b8df376c6b743ba5a257b1f9edff88f3d0ae2d621a8659239a918e53617

SHA512
d5895b6aeaec991773a18b2782c9863bbe928fcfe3b3afe9b45284a5d9c010946ffba64ad7de9f48cfc65f7bd8f0bc3e49429c6818d259859c76907162494adc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\723c513c-93da-4c18-acc7-b80885776924.tmp

Filesize
311KB

MD5
313ca7e5c2e7a05784a138c1a2132b89

SHA1
bc498c59ed9eea41f49dd6677d4d67f3797355c1

SHA256
7aac4c134041565fb3f0f7ad205978bd1bd09d4cea113c67f4eb056c50e2bfb6

SHA512
9acc9152444c8a3c746a46325c5d7c39ba6e012368c13ba9023a17e09da3b5d4213fd05920d0bb3f1ae6606e214f379c86e2c40a64d700e466e6f24344b90927

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\946e2a3f1cd8ba8b_0

Filesize
335KB

MD5
b71b28109a57eb2514f7eedf918ed50c

SHA1
894457401cd17be04908efc44928f588493cee10

SHA256
81f5390bb9fd9c4ab51149fe84d022ae39d11a1f0280a95ab88b4337a0347893

SHA512
425c7915e5a3d311ff8620260247ceb3c0e01d9205d9a994e7a103fd3a29bb6faa7df33f2dfb1b0108d26496741a565136412cece27eecca8065ad1f210e3ae8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ea9b8918ad020319_0

Filesize
289B

MD5
26841415697110f9cfd6cc79f3adb9cc

SHA1
12ddf51f08d1e44b166109f39012c8989cee12e7

SHA256
a268aaf88a5ebee39e11261964da2984a15a54f55280cbd8f7c0d86f29c8fe97

SHA512
4a86659b7785d8f9bf75e9fd67e39f3ef2acdae82049da849821ca8ed2a82cd148b694fa3f74dd820c953dc78a5ec374cd1f5cbc6397f4647236093c5c1f1e95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3a33c1a11d1dc893baf97c20f46e6f41

SHA1
58f3d99bbd7fdfd071293586b920dea5cc7ca3ce

SHA256
b6d8c9aef811ce1d69430bd7aee3c6d6c9c6d1842a889361c45f6718a99108b4

SHA512
1fca2b1d2e4f82eddadde2f6d5d9cfad985372481a6a4b8c52fbb8e1b5f8bb831c0de92746558239e5f99cfdd5bb5ff88efcb8677a569a5cfb627c507d35b044

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
57fa9af7800d997814c54e3f56f2c6ec

SHA1
a2e23d8634f23aab1604514f309e0cdcd5179578

SHA256
29ce6fb79acf3890071f538e735a600e2da9b2bd8297eaa2316107c7625028fb

SHA512
dde606c7f75091c8c6d18c004a33a10f2b2035893f2ae5e546903f4199b391b3a8081ad15761a6273c6083d2e3562267d69215c0ce05b6495625cb94c98a876b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d5a4fde03f03c7c18f0853b5bcbd4694

SHA1
891fc6ff52610c8665d9c0aefcf9bd5f9c0102df

SHA256
07220b9eec2ab1502c1df73be823b32c8a5a3482a700613ca890ea34746ec1a0

SHA512
14a302e145aab1358329236c1df07a48040d3744df36d58f7748aedb50b5556ddcab6aba64e90a12ac0237b0e0346e0914f544dc8b1a9faab9d167082c49d5e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8fca4ed462d92c798f51ee409c77d93a

SHA1
6dc91e9c3c31eae0228012804ea672e859af5f42

SHA256
187455e775d2b1af8ec5895bdbdd3f2abc1e79446c2b68376e7f1190964840e2

SHA512
615e33998fd6a8d182766430b14cc3c0137c4192411f7b40493a2d4716046fdf9d687be88172e848ddae02c30b920b80c819f61745ac8d8ca55038964bca280b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a83f93288cbc8681bc2586f1c2a22102

SHA1
9d1e3240df5efe239e819cb6097bbf8cf9e797df

SHA256
937ff923489173ab79357134f0c00e87a86f3edb0de0f54f91fea9dddf48f1a2

SHA512
0f649745c1c020596480fbc9caa64a9b7cc975117d189e35f7e8ff6260a35933b725d5b7d182cc7bccd1cbaa2f08d8e1db706da490e59fe69adaba6c564487b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4714de0db5254b632f21f4ad510286e6

SHA1
505d1a82363964513583bb8f431e3c7ff8dc9063

SHA256
f9554b981cdb4fc7487da4063f69d1694e3ea40f06c6f642803139e3aa0fcbda

SHA512
bd0355b375df18dfc3943856f6aa70fc0fc1dbcaf19b4a888f10e24a2b6122539b0500fa5a30fe796e457a78205c588afb58a9d1bf483a480525fabb2ee22bb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
797cb440f2dca20b0dd38c9bee9adde1

SHA1
c5b147c4c2ef3567950759801e4341ac0eef951b

SHA256
02733d434a9154e273678f75a0e890ebc3c154a7e01cfd91c3587d6bd40d184e

SHA512
823f7c6496707585932b806589124682a9602942bf8f481b42f7c4d7b4e13186327e28db017aa069be271649378a9c22cfbbd05ddd421d826972d5fea6371c3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b42df279631929bd49b3ba0d74862d4c

SHA1
8e0d564e9a576aa10b0ef2807b186d8d9d451f04

SHA256
d7a3568a925ac3bd7e1e980c9e613f6477b62f37159217c92f881ea39bb82667

SHA512
98a924e4399946c8b921d4768301e3e232eec0486dac7b9aa8c93e365176b6016dd248c8203f28f8ee4028dd31600e5554cbc5f934dd4b2d420c05aa4f4a132d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6d45c6b41a108442202c545811ee7976

SHA1
706248ee01400cb66ae53fdc90499e34c9cb50f2

SHA256
cccdf88c217da4bb71b1226d9ce2c9553302f93b9763328e616e5992b044f1f0

SHA512
6c26ab1e49bccf64e5aa97d5d907b404bf4ab746b96ccf3fefa6e2d3b6c03c1abf9edcc1d427e3eaa2beba107def7ff05b841279da22bda560189ac2942ffe65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2e3869b25fb409d2d2e57622cc3719c2

SHA1
8838bd7f1d09e7f5467d441e0aa345b3968c94d6

SHA256
5e840b7a6ba965d6045568311b77cb4d6d8a7cf953da2fde6ef44ab19f7a3bba

SHA512
bd25cb2efb20d9359196a20a35a36b3e03bdbb36a2a967bff55e4c48a8f15ed76f9715c04e55fc3af725a5ec9e96903754aeaf43304415927ac5641357fcb3ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1cace2e9d45039325cb691fe1a334e4a

SHA1
20a37c26749ab5a2f8778c678d9927e8c231beeb

SHA256
a6c96e0c4b104318700ef923e0522b4fd951b7dcb95319813978ceadca9c060a

SHA512
0139f6acfa602ec957e07250e94841cfa1eb2e65dc4b4d124ba91d4fbb97424e091dcd6511e2452c486bdffe71cfcfcdc392209a70197a43050e5097f9c42d4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ad4f611f8e519f58ebf44da16214b27c

SHA1
2dc516cd0a144e13fd219c46c193ac8c5a7dc4bf

SHA256
d77d9981e4c31d46b0ee1cfc98fb8bbc0597ad1852c69c15814373cd7fd5c660

SHA512
401785aa07dde57df2034ade80f6c8b43af86b72d0cf760a1c407a5c7d1a5fa55746a1d991c612a64741491b1d3aab22bc3147170def98177ea492fe25949328

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
86678c95ae0d72e536302ec08f13b9ea

SHA1
22af40c5b3a19b1d835f72600f44cf28dd61ba92

SHA256
c4dd9754e02ad5d87a3719227f25ac71fe4e23e717bb72bd4e721653a32670ff

SHA512
6cce1614affb09db4e9010f8fa7b997a7a8edc996a545bacc69770a8f582a832cd414454b02db1f1f845bd6cd027b4d6f2ab0fe71b2100fe9935787db3428254

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
8c3603c55a99d05f22bcc918fa87d9f7

SHA1
fc2100ac58dcf8ed899fb2bb68fadf712ac5e100

SHA256
c6de74c31c17294f991e615666e0a5e637410e2c14a78696f50a03fcc7f2b1ed

SHA512
362702931cf0618c49d2355cd4c2fc695a498ef487159fa877a5ed1da25e2a9916c7c68c281f88955ce1bd599d4bff02f4063c508c36079b24972f4a7add7894

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
e01ca06278ebd7911346d42d1206dd37

SHA1
824131760b248769d599c1a648b4f4ba2fea2f6d

SHA256
6b8cc32d41615f0dd0310404ce85c499af8b49ece98392bc23dc8c692c57c6cb

SHA512
7c94211835c89ce1562df7d6c5e016ab688adb25a550c3027e05cc2f0ff0ce24a870f79e0e1c55af7c6cbcc177cd7c88052c8a0e9d92d8db1ba5aca852bb209a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
311KB

MD5
89c02562c32d60d307f2ac467450fac8

SHA1
dd387cf928f6acd6c7db126a41106085f0cb60ac

SHA256
373193faeec07faa09c615c7e3d794d3db5828ff820f48ef7f2cb93c19c61f1a

SHA512
eba5152becc32cf30330219adddb58d5c8a9c6d3b7424fe8cb6c1bead796396a8e3521064256c8b16ccd39bc7e843fdd241320fc919af029978cb8678978519c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D9E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar405F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1288-3-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1288-0-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/1288-2-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1288-1-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download