38f09edc87d2d94f3e8fe2e6119be2285e2e0afd64d0c4a53f7d62c9d8f9cbf3

Analysis

max time kernel
122s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gdswt46g.dll
Size

12B
MD5

dc72bdebf3016a463eb4e209af1aefe1
SHA1

9bde7acc8b748a89daee4d756fa57ce3007e82a9
SHA256

472e48643c0b957bb7c612448330f07ce0cb71e14541c6b0b9ce789bc82e91da
SHA512

de6999ebc8dd931a4417c6861e36127a6b7caca1543f1db94eb90c3624045ee57398d2fb1a4841e0647ac0191ab41a04d6dc8642c7f1b888743a03a985c65ea5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434374596"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4589C71-83D2-11EF-8334-424588269AE0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	chrome.exe
1596	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe
Token: SeShutdownPrivilege	1596	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2180	iexplore.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe
1596	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2180	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2660	2180	iexplore.exe	34
PID 2180 wrote to memory of 2660	2180	iexplore.exe	34
PID 2180 wrote to memory of 2660	2180	iexplore.exe	34
PID 2180 wrote to memory of 2660	2180	iexplore.exe	34
PID 1596 wrote to memory of 2812	1596	chrome.exe	36
PID 1596 wrote to memory of 2812	1596	chrome.exe	36
PID 1596 wrote to memory of 2812	1596	chrome.exe	36
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1532	1596	chrome.exe	39
PID 1596 wrote to memory of 1568	1596	chrome.exe	40
PID 1596 wrote to memory of 1568	1596	chrome.exe	40
PID 1596 wrote to memory of 1568	1596	chrome.exe	40
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41
PID 1596 wrote to memory of 1696	1596	chrome.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Gdswt46g.dll,#1
1⤵
PID:2352

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5a59758,0x7fef5a59768,0x7fef5a59778
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1444 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1396 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1180,i,6738096183420485061,12006292263581142083,131072 /prefetch:8
  2⤵
  PID:2072

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4e502eb02c369a611d6050a7e310123

SHA1
46fc70f716a888cf875e77a222404279b310857d

SHA256
54695d5cacbcc0807b79eabfb55bf45f7dcdf4d459cec662f6dbd54d01c69547

SHA512
1a4f81c5aff6a0ec07f7c088cc434d67d5869dc3a728d7bf83d1b1b81ca26c7863d6b617458e8463a938c8b9fe911f340c5933c7b88aa8ad41b70136e3582a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4ed924b8ebccefec0c3d01575ec563a

SHA1
a47cf43d78c8145593171e44f8bf7f3a2c3ce7ec

SHA256
76bffd93600103f416623676a3f58e50e2a42172becf16a7fd985e1be401442b

SHA512
bb94a288825eb7cb054b6550fcaee8a8338bb025b93119c2dad7b958e80f7c78f7e2f8b85a11a966ab0863a663fe551f96b3ad88dd3e1b58ead7a586ec1444d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2829dde00458fb974c213bffb5d4af27

SHA1
9cb4f6f39d7a3de4665f92f480cfc637ba4e842d

SHA256
f3f75ed0378aa5031ed2d73e8983674cc3e0f3a4fd53be43084e1c3d0c7d18d4

SHA512
9fd55ace4d3296c388da862045320fafabca107bf3aaa3d1a601b7230ae338c9b0e4672cf569e3004232012dc5e3733e00a61499fd13c2efc26024e72ca8493a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11fedf75f650efd4ed215306618688c3

SHA1
1269cda60023e030e747498b018325d4d1405c64

SHA256
b74695c58e46cd1ab65fe36acaba1d16bce16c82a014f246e0fff0360269028e

SHA512
7e616902fb81e9b691e3d69a539ddc536bcbc254fb281122a75654da3d41f0f7d4963a8e91c4ac237d57c05183bd25552cdc73c5e6688a9cb631265b251fbf72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2593aaf449f383b229f2919de299c023

SHA1
0bae0825f2405f00a8a7d4d9bc5f7a314c733c25

SHA256
6605c323fc126b88b26168f908e5761db3b95e4c41a897f5392f7dca6e9962b6

SHA512
668e6aa31d97dad297e6cd3b0b459dca005f8c1a52abc753b6fc156ddcef664bf2211bdd62e58177eccd36afec7e17d4ba0c227ce29013d163dae2b3b999ae24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a74602ea8b5165409b6d15832b44f7f6

SHA1
bc8c9bdc2d1695983b8da03bdb3f84dcb3a55213

SHA256
fca197e52a9c1e1cf7d36623a4dba3c6cde3ed8977dee1ad88490d576a582001

SHA512
0f7c58f27729612c4bc954bb7549a32a2e6c733a176413413add84ca61f750d59d5baea930358ff0bc0c4bf79f1a3fed11ccdc99f028976045305d110f8baf81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19795ae703129bf5fe4c3a2e4505d792

SHA1
f08a60b22ba2c2bc6f58cde2fc0e60fb8784de5b

SHA256
b1f1ac97c2a9352c12aebdfb723f6e4208bb9839ea0b29c578ccc3fd4b8f420d

SHA512
588b5deee8e6697ffdae1da00ffd66cd5e970d4b4cb9bc8f6e9680e49a4f0b5e7bc73488103a7ce1abcf13053feb0e7dd3e0d2fbc03be30039c3aeca28783b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b084884604321da999acb908c5ffd63

SHA1
8ec07d1233140c61da172a4f0455f8d87e86db34

SHA256
1f0e6e7a1780ae11bf3eebe2a46127cc871211c214ba1b91c8ae5dbe4ae8b180

SHA512
ccb09bc65e78a4cbf619ffc9101ad7a7a06939cacc89de76d9ccde7f02499bc2bc8cd573c1782369f24710a7ddf553a3366995e2204c1f69ec95b32b4eab34a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
770cd514d91afec73dc3f90ac05bf5bc

SHA1
9b609a14d24d78ee7e4c199cb71872ad8b449a15

SHA256
1be7b5c54b7fdea93ae54ce525b229624f70a14193f1b2721d0030f79f7c5301

SHA512
eb2ae893352c4dad970cc75316ed7baac0ed05c1b63b51eb7742783dc5d750b23448b153947821a425a58b90c27d9532e5a648742cdd67559adfdbfe645fdd95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b38cfb25f300a7c8ac209f053494ff08

SHA1
cb66097f085bf24da8191a7c0038b3ffbd424ecf

SHA256
3e6767c9a18cc2805cc314e725e618991427f824cfc929aff031be950e343b9e

SHA512
38dbfc66bda98656defc0fe33be6a06655f5e98e6a568c13d961f4e6d44c798b49043d97d6fb3299d3c432fa656ab978337ac6265319a046f39cea81ca8402a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28f808fab3034fbf2432976d42396ee

SHA1
7614dfc4e23d05d8a635fdf5a7f67dcc711a20e4

SHA256
2044e16b220568e2a15c0fecb400c8c9df6582eaff1ece07e4881189fe163877

SHA512
7d6f2d3f3ea06910f7fffe1c7446809d18655e79a3353a06596e2701be5faaa345c981d452e025f26f74fc863639d68bf32332e3c690e534e73bdf26fb5e6afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0e85e32c0325c1f5fc59aa239b3eb0

SHA1
a6bfaaf254bbbaa90a179d68f1d106703aa651e4

SHA256
a494b5ff16f94ea7ae51599c26116ae9ae65a5ea9a0c6a5108d3858f0164eafc

SHA512
f53da5ce667cde8944ea2e2a917bfbd3d9aadb480b9f92d268bfc0236dcf5c1d3398f1a7f24c58072ff36c222e36fea0ff3c1bf208f64cd644725550d4399489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
771619eaf5a8cd07ec971ac7024cb04d

SHA1
14223ac8b3459cead9da7ecc8f1c3e26a900f99d

SHA256
3365caa07d6344657048a725b8aa54dd698648bea87070c1e1457d2abe326532

SHA512
e3387acc329271548cd29d7f72c1ae1ade1bd9e9fd8d8a34ab8cd5e8a16fcdba90e265bdf533d36b667db9af4efb815908ecf97977a95bfd75e600f11c19d97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62fe74d701fcb359de2ee68b6a210158

SHA1
f7830b74eaa4db6f424e6d130873bde236535ec5

SHA256
6de56a04b0a12c43e3244a61b27d457dcf8ad7200b9608c1fef409139792522b

SHA512
ed454777a80f26af0b7c8900a1fa94145841e42c8d262e29416bba8d0505e743692781711a00e409eebdecb060e1c3e082264631d4fb88547549c91aaaf47a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaffc196750441fd3f07c70044e08806

SHA1
131689ce6a04cbcd4354c3fdd9b8b89490f4d2cf

SHA256
f6f8cbc357ca4b5361c0b4b506891fa91e5aefe26ad6716c1a6bade3b7a969f6

SHA512
c8329fbb1b715b79cc6d3cd7d36e4638e0e4edfdc9b465878e209dabc3551df21dc4b245886ea74eb118420ffc030f864732e45c35c68b290b152f24a9e4b452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ef4fc1f47426321fbb1a9a7ee4eaffa

SHA1
04522c43d5582c98ac6a7cb35af9421db7a3ffbc

SHA256
f81d4221eab12c475cda4739e9b81cb002b65ebe930cb87ce3862a1dee1a59be

SHA512
df3654be603c991cb635ff46e7c42956fb6f899f64b018d2cb32c23e840e759a3251352d7dd04f8c607a21b2a94b624429c3b9da8ceb831ba952ae76f7a113ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
b714f5f2e69459cc18b610122fc5a24c

SHA1
af817a1845b9438d565868621ff069d1edfb4186

SHA256
ad2f07628e74f9a57d33b4bdab2e9a05af85951a171edc81192ea17d6c987a18

SHA512
336d636d8ba56289174e2215d9ab27abc0f0e445b14467cfb8ca6c40833d38e08c13ed26a6d89911d547ec41a0767cc18a524a2ae1085f35f4328bb4243e3a94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
37c375bf85f8250d019b2ebd9fb91c46

SHA1
fc3a8aa9ab73e8cf11b6362bdbd82a2cc3e3ba1b

SHA256
1acf53ea18a81087401b76b5252e1f529dcf664c1e52247be442a88ee18ec898

SHA512
93d39a8601ab970495a1e15a54ecea4b959e5d2266ae8c980c2199707f0c2c0e675ed55e3d47de865ca694daadcade13ff25e1267a479e9b949befabf1c91e69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CE6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit