74be66125d0ddee38181d7dbbe5d2a7128884ca857b60290cbc6117d639a8e73

Analysis

max time kernel
125s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Boostrapper.exe
Size

10.9MB
MD5

6390418430110520a4d006b0c2ab8d45
SHA1

c013eeeb2371dfdc5bd8cdf6089755ec194651c8
SHA256

74be66125d0ddee38181d7dbbe5d2a7128884ca857b60290cbc6117d639a8e73
SHA512

a2760ae467cbba2850221da3d6ff2cfbe59ee6d4bebd84274d88ede35317b8fa13e676ace5d10ec6cf0eba945ccf8ede229d311cad20adb0cc6eee24308aac30
SSDEEP

196608:T+E3RBAYZPJb3tQk5tOeNvX+wfm/pf+xfdkRoTvKnruOLW0D+qI:dAYZP7v5tRvX+9/pWFGRwCnru8R+t

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2020	Boostrapper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
85	raw.githubusercontent.com
98	raw.githubusercontent.com
99	raw.githubusercontent.com
100	raw.githubusercontent.com
101	raw.githubusercontent.com
102	raw.githubusercontent.com
83	raw.githubusercontent.com

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a4aa-45.dat	upx
behavioral1/memory/2020-47-0x000007FEF5970000-0x000007FEF5F58000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	chrome.exe
1736	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe
Token: SeShutdownPrivilege	1736	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe
1736	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2020	2712	Boostrapper.exe	30
PID 2712 wrote to memory of 2020	2712	Boostrapper.exe	30
PID 2712 wrote to memory of 2020	2712	Boostrapper.exe	30
PID 1736 wrote to memory of 2952	1736	chrome.exe	32
PID 1736 wrote to memory of 2952	1736	chrome.exe	32
PID 1736 wrote to memory of 2952	1736	chrome.exe	32
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2060	1736	chrome.exe	34
PID 1736 wrote to memory of 2964	1736	chrome.exe	35
PID 1736 wrote to memory of 2964	1736	chrome.exe	35
PID 1736 wrote to memory of 2964	1736	chrome.exe	35
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36
PID 1736 wrote to memory of 1352	1736	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\Boostrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Boostrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\Boostrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Boostrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7929758,0x7fef7929768,0x7fef7929778
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1552 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:2
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1384 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3436 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3644 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2616 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1428 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1124 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3872 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2312 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4036 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=1944 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3796 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4160 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4296 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1912 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3780 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=792 --field-trial-handle=1300,i,5271160149594020307,16834372716085358133,131072 /prefetch:8
  2⤵
  PID:696

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e5f4ebeadeabe478543792acb8ac9ea3

SHA1
f382d8372d873ba6afdbf114fa4b78dba0ae6cb3

SHA256
ebef0b4c89e3747656097ff7884d85466973be6543c7b844f67f08f119df28e1

SHA512
a0768ab4ac97ba288122568569b980a9bed94ad3573491fb135334fe57279c70ec8a2c08d82b527d241818b244a94f66cc63d18f56d64878899e4505ecd82861

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4d7a41edef6ea2142a19decd78e55851

SHA1
b40650b6445bc8142e01ffac0c301c210605f13c

SHA256
f6227b08cb183adb0dcc8a686aa5bdaa5e8e8c0846045297d6bc8e485ca807b0

SHA512
903eb407e4503d546b8c549b04e72f8ca6c8342ad99567645a60fbc348ec46698d01cf13628f6584fff4110714f1bccfe1ad300c7cb951c3abb72ffa0fbc6cca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
0b6a03ad0da65248dafc2cce166a95ab

SHA1
7b105e3c6e193c195bc86a3a9879d74cfd7f1249

SHA256
c5a6b8289b291dbd74ea3c3536b9945e247ed86874bea6f6fc7d89cf290f0903

SHA512
b2b4c57b270cd74a180f307ace104be239530d1034c11e4b5c924228bf26eacfcfa7753749f461c72e021733678b7a34ea848ae8c6ea479ca3429eb9cda37dfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
a4c98d56a35a094fae3ad83bab130c7f

SHA1
eecd4dc7adcb1d050591be65b3a599e556e72adc

SHA256
db358782a570d9d56f832d223e3c59d77949a50d5f630241af2e6fbc20cf4302

SHA512
4bf69b42a4abca7010cfbecc7092899294943461943e10fe5494cd0a35fce9cacdbd0573af3cec460d5fc35cb40dc8e00336b5692d749c129176edf7b9e872cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
31ab103e267cf4209f138ff9977e744d

SHA1
8f33c4c7b0896f310d0da3899155e1f77f7f6d05

SHA256
7ac680b02ed368bfb7f27a8491d0190a62ca2538f5c00a5181b0d5b79545b67b

SHA512
7731666da87cf9e34e347a24d47a6335180d968b82ef12ee17979082f0329022cfa47e04d99c23ddfcbfb3aa7dcff7d1c76899cc18614dbe4e19455c50ac4ddc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
c17fec3c9e37ce48a1172a9deffb8dcd

SHA1
5e7033fddd6feed52a8266ef773c87012ce5fd61

SHA256
9e95a0833cd794f6df6f96491af0d2446ba7f0b8c1ce32e809ce7776253a0514

SHA512
e30192535ebec16139a880e77a0c5c36c7421e0e399f4c8c714a205ff6519f0df0bc7e49e92cb5d550e507e5e9eaaa4a350ba3157b06a2b57b00ddcd34443e67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
6b1d05a79fc36abf648524b3d334ef94

SHA1
5ec8444026b290d06b524dd97322620c2c387d5c

SHA256
c787e610457658c8fb7593af6c2625850e3dd29ede81ed1b0be9c3298a1ad417

SHA512
596f75e4e23fbbc5b11cef98ee79c8734d9f56ad110cfd4b3355a240157bc44613c784ce60db0191ac22bcdb8034834349d391edf7721d4a6e8428a3d6fdb28a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
d27939daa45cf1cff17a2f084f09f793

SHA1
d5220ebcf33e6f4a2cfd58347e35c86e69244cd1

SHA256
e16fb962b48ebe17d4d240073d2c3cfa443d723469dd5129f8164e371c15738a

SHA512
5e1d0f4b3e9a42400cc15c3780bb58c15ee28b6c136c938c5df15522b1bb6c2d4ceb84438d295ac8ebff96e3abbd8ef87fca727869cf27db141094bffade3f86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
1e3c6872b3b9e2d1874b8533e5217b71

SHA1
2929e0491a23d319899b7db108c651b435604af2

SHA256
b481581ef1b310714446d411e248c12c83ac54908faf67395264c98aa286608c

SHA512
4833024b496917c8b4644f158ce0500611db01ccb7b4ef454d077eb0881f539f98662fb9e75cabb63936d47718b488ae5159a668241e8bde4b1052511eee5160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1670ab4cb02353b4459c53419fe42abb

SHA1
fe78c64fa6505200d59ed4caf4b3ba890a7e4c34

SHA256
2315a76094e8bc1e5dc5fa95eafef813cc90b2e9beea4113ed14f248791b9e6f

SHA512
03082fbfb9c23fa28a363f95e95d1462febbf3d28274251bb3a9fbb3ea1a5640bae2ece928039c794dce8ef226f8c953a234d569e3fe07260b95e2b0b04e8bd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0bda7f9fb68cc26f507dabad5b711419

SHA1
87e3115fa7b48a6d526afb0acf6a36a1480f376b

SHA256
fcf2b546806333873235f80b4b98d42863bbab4da648a755ecd8ed4715c7c0ff

SHA512
2f92905ce932c18d130facea7c2d2cb527a8c201ac388a077f10d84968b5e422f76fa859c9d4380183fa41f15546a3bf8aa6a4cdbc15ccddf62fecf6654e3d30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c2084145b7df03b85f8cced47c0c4201

SHA1
96e3b92fc411ac06407cd45020591d16de1ae786

SHA256
c6ce92cb9bd68fbf597ce928d278047a4c01bc804cec4a7b0a89117c545b8faf

SHA512
cbceb6dfe9679f3ec70d1d0936a2732b07400a3ee060badefc4ae6974bc3d6b46093c804465864533d65208e30dc910624f3b619736ccb14064207c2045e3fc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
44f663f02154834886e6f5c45c61dfb3

SHA1
3f9b570d37682e6da9262bed7c2bf99e8ccabc8f

SHA256
4fcbde0d87f51636c56ab4deb85d7ebfae2df1760abb87eb586e195626bb0d69

SHA512
bb19a66ff45d064358e1fa1debfb987349f1095072c94f45b8609207d11d37bbfbc05e1e2cdc45d84cc47752de3acbf3c9aae2d3eb33e3b371a12c542807ebd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
09f95ab61a330ed56353a2faf0a6ed79

SHA1
636b71aef3f30b27c46b704e329c9637324cb523

SHA256
8ec107d61f40d1c7714ecd1311366b29ad01f81f44a49922e3b16b16a9e67a34

SHA512
3c3f12daa3c90250047c17e41a4bd5e194c7a1ab3c3da1b4179e420eda1502ac863055cf9ab224c48a3ea99f5ff4749858e683ffbceaf6a110267919df557587

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e91e546209fcd323551495e27938f275

SHA1
2682b0b123fd8fe9f5582be41c67dea12da5e363

SHA256
6a6c5e9e8bd2741583bd3571825a277899604d7a15b0bc26141ad66207469043

SHA512
c18d30796c07d40739a27ccdcd16c5f4e6565622d750eed0c29cd0c8e8ffb0fdbeb8cf5e6c0987d81f093ca55d2ff3962d0fe41407a9f0c6df5d31c394e71231

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0c78a3452abe5ff7f108481b20121ec8

SHA1
e17ffa7d90a078b9e92adeaecb47cfea227dae09

SHA256
de2e31acbc819db439092f85b659611182685d07f1d04465adb0afbadcc5ecf2

SHA512
cf63416f20a6fdc466dd9d23db10fcaa8c96ddccdcce3716cd636c709c518a4bbf10a20f6608b55a334b8d1f71e50e338d4c1b4ec22615f4a3c55c2e58bba5d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
341KB

MD5
424ba9bb90a1e6903e34318fdd10eb04

SHA1
f450c2d98b1c8cbed62072ad1ad242f4196c1c01

SHA256
39ae85728dfdcd8d1eba205a755b8010ac2822d79ac1473ddc145c936709fe80

SHA512
250b3ecaa89cb2cce901c9cde2cb6fe7288df3bd1a77e5b0ae9100481b67028bad6de2b4048fa9b91ade04052605b3435f62e1f56e683795a8496931661b944a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
82KB

MD5
206e885159b2291d24ee57eb3eaee26d

SHA1
91568d8979d454748e6069a95bd23581dc71b60b

SHA256
4fdeea365a52cc75b70f6a1fd06ff207a521d406a53e234e6a8583117e208e92

SHA512
36e8f5e7e39121b3f1f177df0175bbb6c93c0861aa5d027a657adb672cad21a23664401104df0e6cce05f4981006c5d38a0bcfb35db0f19809103c5efd1cc9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
78KB

MD5
2ff555dd88d93071f4a1fc8d35d95046

SHA1
fc741c39098560e2eed2a6b7f540507475e38938

SHA256
a21a3e491fa3234e06e79356c7761d95d42e0e1c0559818ecf54a8544c774990

SHA512
a0da5382485964642ae6b4b3d0829dc070f87b699da17a8149cdc7273247e5d78d124dc938661ff86d4df7631b93da8204e495cdfa068b3b63449e234d299df0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
81KB

MD5
96995376571a8a4330a759b17aff6f6d

SHA1
0c65961da4f98cca65c46a9e9270b4bf96596cad

SHA256
525564c43561378d0c81374dc283599260f22ef3040373440212520e418cdde4

SHA512
f786b365a9893d9294bce86af0a6c3fddc714a3d5a030176990452129063de188d8cabe194a19621a853baa8a4090ce8ed1a2c3290125648258340e76e9e0b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6ECC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EDE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27122\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry (1).zip

Filesize
3.3MB

MD5
efe76bf09daba2c594d2bc173d9b5cf0

SHA1
ba5de52939cb809eae10fdbb7fac47095a9599a7

SHA256
707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

SHA512
4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

Download Submit
memory/2020-47-0x000007FEF5970000-0x000007FEF5F58000-memory.dmp

Filesize
5.9MB

Download