e14419534d79ebd665a8680bb8a37d7aa9c62804aaa1c14d72303ec1c865e0fa

Resubmissions

11-10-2024 12:58

241011-p7wxwayckp 10

11-10-2024 12:56

241011-p6mmtataqh 10

Analysis

max time kernel
89s
max time network
222s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crubby-SetUp.exe
Size

7.6MB
MD5

e9af544eb8111fd21728de67e4f326d8
SHA1

bfaa8586a473265f291e9bb226af4680edfbe64e
SHA256

e14419534d79ebd665a8680bb8a37d7aa9c62804aaa1c14d72303ec1c865e0fa
SHA512

2745c59d4bf07313493198d6fb6578bbcc2a6c40d98fe4de78e0af3b93247d083a376136b7cb6564fd1e971ca33d2c8deb5510d9f640d8da00526b72df092e24
SSDEEP

98304:AqH+ImMcr/urErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuI/KU73bcgVowjf:AqsurErvI9pWjgyvoaYrE41JIuICox3

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2696	Crubby-SetUp.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000194f2-21.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2696	2504	Crubby-SetUp.exe	30
PID 2504 wrote to memory of 2696	2504	Crubby-SetUp.exe	30
PID 2504 wrote to memory of 2696	2504	Crubby-SetUp.exe	30
PID 3000 wrote to memory of 3004	3000	chrome.exe	35
PID 3000 wrote to memory of 3004	3000	chrome.exe	35
PID 3000 wrote to memory of 3004	3000	chrome.exe	35
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1252	3000	chrome.exe	37
PID 3000 wrote to memory of 1996	3000	chrome.exe	38
PID 3000 wrote to memory of 1996	3000	chrome.exe	38
PID 3000 wrote to memory of 1996	3000	chrome.exe	38
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39
PID 3000 wrote to memory of 1804	3000	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\Crubby-SetUp.exe
"C:\Users\Admin\AppData\Local\Temp\Crubby-SetUp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\Crubby-SetUp.exe
  "C:\Users\Admin\AppData\Local\Temp\Crubby-SetUp.exe"
  2⤵
  - Loads dropped DLL
  PID:2696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5e09758,0x7fef5e09768,0x7fef5e09778
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2088 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2096 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2904 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:2
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3196 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3404 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2740 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2128 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3196 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2580 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1688 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1716 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3204 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4268 --field-trial-handle=1376,i,13321096473052044025,9193749590910682729,131072 /prefetch:1
  2⤵
  PID:2904

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\75e637f4-bc8a-45e3-a840-3f02389f9d03.tmp

Filesize
341KB

MD5
2980367fc379b568f0bbaf9a164097f6

SHA1
4b2f68a4dad5762dd30f104eda84f7ddf7671ba6

SHA256
e1d55aa0e58be048a234cb59a4fc120b9aeee7ab12968e93c1aae006d2b3d807

SHA512
108a9cc79459731dd1c5de3b65e0157b51174c3a5b168d6472155abbe76ef1b1f57ee4f24194a994f1d7f07fe1654913f5b4868da2340eaa0d1103c21e114b0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3dfdb339-0aa7-4512-931a-4f7c7262e70a.tmp

Filesize
8KB

MD5
fffa850d662aa970c845222873856215

SHA1
f486ebb8481b94b24dcd2ad3408f284a4da3934d

SHA256
7a6f758453c8d342f8c8eced74cb362e3b48f72cdee5f76f8df8d24fba69664d

SHA512
257ee3bb6baf6ce7dcacf58fb2b51bd51025e3290a5ebf907f02769b5313bb19b8fb3b1c251d3bf991b001e16318bc33aa14759cabd8f568256809b5d028a356

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7f42840e-3942-45b5-a831-7059769c28da.tmp

Filesize
9KB

MD5
3063fe0a5014e8d803a2edf4bda5a83a

SHA1
41fec175e8a1a43dcbe49fcc2234988700238582

SHA256
d334d017e803fe1bdcfbfb817e959e7ac8cb3f7480d3e567c1e4aeea635f5696

SHA512
45af0a779440a4c785ff431fcd57d0e637d0f3ba12fd9768a5f5f91e6720c3399ee335c691ca0177ae958d6173917c86afacae52f08afb6a08aa069c0a1ae452

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c8cde7a224ca82ef816ccdcc13727d60

SHA1
b043fbd677f36292f7cf0730259147b214ba61c8

SHA256
f304934a720fd05ba9b07fcea62a088535fe0fa7ecf3c58fbb81d81a61d0286c

SHA512
6e492665e80cda93f444a6821ea845986d92d6d5e01bdc6007258adc904e381526441244111dc11f455f6681fc70401d3de0fb004d0a54aad0e6af21002d938a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ef648b58470c1aabdbddb502d35c7f95

SHA1
50188a8f35f3f6fdea9975b3a5f832af6edb887c

SHA256
2cc1e5573472b8fd637a297554237696495ebd179dafaa25ed8af2a36ba7d711

SHA512
1e86ebfd6b1a1d2e46859866f0e694840aff6dfcc9f11c27ee1eccc7ec91d7fae12173c52aab41b0424a031ae2dcece66b8911582d1893250df921479d1bf1d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
24d52cb7de661c0da38a420322682a70

SHA1
4926dc8f3bc3611b467cd2606c931e625193d9de

SHA256
992c1363a533f47538c20d2492fe33b74ab42e5b7b0235fbcc91d3e5c074a2db

SHA512
196be7af80e1000d3baea5a459f8da7b2dee5a92a3f3b8af954b19c0eabb08058682cad81722964b35e4cac0c798bd527db4f5a569ecba8e56bcd54f4919ea27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
359B

MD5
d40a19939f38e1ef5e61e3e6cd42a056

SHA1
af6fb847ad59f431f2ff3de04f1f104572e95954

SHA256
c55be64e0cea0a31f30e3da0e2b64f9a7e7055c98b6f8319c035c674c92f44bd

SHA512
19dfc0c4f086a675050fc5aea31c2575cca7900820e3ad05965309aedb25b4b46a21d48d70b359f555d0166be3b2354678a9b0245dad62cdb2c9e36d578929da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
359B

MD5
5e5b40e4e0afe3497aaf974e0d7f3ec3

SHA1
77c3ef7588e761f434e15e5b3c29bb03315162d1

SHA256
ee535e4d3eaa85203d8c3ed865a0a106e5148a90ca3a0c46568648ff97227d99

SHA512
599de10c490bf26901a739fdd172ea2150a89eca204fb08d06e179e9a8058f146bf41669b65d0700d19c8d2185e9db0319dcbf59716e54caa59aa9f8d5e40b0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
382797922939ed0f6fb7b1ba3e199dc9

SHA1
fed64d37472e294e931964493ed2d86ff998cc20

SHA256
dfb5db9ed11fff4101155c4761a5b4899ae4e0897dda2f908d171390fabff79b

SHA512
7a8f3e2a989b9ab51f84b96ab477fc9677162ae3ca207484ef48ffcbd161c8e1efa39b65dfb2532e42cc284706a15fd04aee35f6bd5880d2746064301ef756f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
893d624d4be63a8429e2f6f72b0201fd

SHA1
2ccff10e01d1cc85642c17c4602fd4e6f2142f31

SHA256
00a5326cf64a4428e384c3be8ecd18f444c91921b2c6a0b61ed422d82703b5bb

SHA512
29144572f9475c8c927d4b6a934e50a1e1209642572d22695e6b217e34458a531f4af7ea2caaf97e9070e984dcb2b5d16523cb06eeb7d4bc55b4d52297237a3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2451bccc9874c65d45e61a9b1c89b5c6

SHA1
3d2ea1190aaa1ec15685e10bac0c22cd44f4361b

SHA256
b3365cfa51ad657bc82f3e758ed3da264f3362fae39469917bf8e45100a29abc

SHA512
bd1bc89d01e345505e850baa8c6812358e6dd30cfbc19c1556834f6e204ce374a9f041500dd6ed7d06457f096baca466f0c9f47adc44e3839a3882fbb47c4f95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
341KB

MD5
f67316e0050397588c02857cf2152365

SHA1
943d134a214cae85016ecd77c89c9f9fa0ed24a6

SHA256
0c5653a6eb9bd7da63b850edda999038d22ae97bcf75001859a3f95cf0a53d61

SHA512
622649807cd9f565c710e6ce4c16f82d0313647b514d75a422fa0b3f2f9823f251517cf42ae9ea62272d3d48e6cb5b01f768058a42d882ddd869839f942d1efc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
341KB

MD5
fd8e318b0bf9d445514d93cd9b13a3f0

SHA1
6230f729668795f695c50707b2d6f47c3f4261cc

SHA256
652f08382de63860516ed64a18200fe0e5679219238bb3a4f51a32e2f826d280

SHA512
326b73eaeb8a647b3b89d02a316d3b05838a487a74277a4ddc204c0a8a7c983468238ad2739504022dc1ab09dcaec6b7ef071ce45494f74d0495b6aa0572c6a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC18.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC59.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25042\python311.dll

Filesize
1.6MB

MD5
b167b98fc5c89d65cb1fa8df31c5de13

SHA1
3a6597007f572ea09ed233d813462e80e14c5444

SHA256
28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

SHA512
40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

Download Submit
memory/2696-23-0x000007FEF5460000-0x000007FEF5A50000-memory.dmp

Filesize
5.9MB

Download