8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
71s
max time network
111s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3024	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	chrome.exe
2696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1780	WMIC.exe
Token: SeSecurityPrivilege	1780	WMIC.exe
Token: SeTakeOwnershipPrivilege	1780	WMIC.exe
Token: SeLoadDriverPrivilege	1780	WMIC.exe
Token: SeSystemProfilePrivilege	1780	WMIC.exe
Token: SeSystemtimePrivilege	1780	WMIC.exe
Token: SeProfSingleProcessPrivilege	1780	WMIC.exe
Token: SeIncBasePriorityPrivilege	1780	WMIC.exe
Token: SeCreatePagefilePrivilege	1780	WMIC.exe
Token: SeBackupPrivilege	1780	WMIC.exe
Token: SeRestorePrivilege	1780	WMIC.exe
Token: SeShutdownPrivilege	1780	WMIC.exe
Token: SeDebugPrivilege	1780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1780	WMIC.exe
Token: SeRemoteShutdownPrivilege	1780	WMIC.exe
Token: SeUndockPrivilege	1780	WMIC.exe
Token: SeManageVolumePrivilege	1780	WMIC.exe
Token: 33	1780	WMIC.exe
Token: 34	1780	WMIC.exe
Token: 35	1780	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1780	WMIC.exe
Token: SeSecurityPrivilege	1780	WMIC.exe
Token: SeTakeOwnershipPrivilege	1780	WMIC.exe
Token: SeLoadDriverPrivilege	1780	WMIC.exe
Token: SeSystemProfilePrivilege	1780	WMIC.exe
Token: SeSystemtimePrivilege	1780	WMIC.exe
Token: SeProfSingleProcessPrivilege	1780	WMIC.exe
Token: SeIncBasePriorityPrivilege	1780	WMIC.exe
Token: SeCreatePagefilePrivilege	1780	WMIC.exe
Token: SeBackupPrivilege	1780	WMIC.exe
Token: SeRestorePrivilege	1780	WMIC.exe
Token: SeShutdownPrivilege	1780	WMIC.exe
Token: SeDebugPrivilege	1780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1780	WMIC.exe
Token: SeRemoteShutdownPrivilege	1780	WMIC.exe
Token: SeUndockPrivilege	1780	WMIC.exe
Token: SeManageVolumePrivilege	1780	WMIC.exe
Token: 33	1780	WMIC.exe
Token: 34	1780	WMIC.exe
Token: 35	1780	WMIC.exe
Token: SeDebugPrivilege	2084	Bootstrapper.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe
Token: SeShutdownPrivilege	2696	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe
2696	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1256	2084	Bootstrapper.exe	32
PID 2084 wrote to memory of 1256	2084	Bootstrapper.exe	32
PID 2084 wrote to memory of 1256	2084	Bootstrapper.exe	32
PID 1256 wrote to memory of 3024	1256	cmd.exe	34
PID 1256 wrote to memory of 3024	1256	cmd.exe	34
PID 1256 wrote to memory of 3024	1256	cmd.exe	34
PID 2084 wrote to memory of 2188	2084	Bootstrapper.exe	35
PID 2084 wrote to memory of 2188	2084	Bootstrapper.exe	35
PID 2084 wrote to memory of 2188	2084	Bootstrapper.exe	35
PID 2188 wrote to memory of 1780	2188	cmd.exe	37
PID 2188 wrote to memory of 1780	2188	cmd.exe	37
PID 2188 wrote to memory of 1780	2188	cmd.exe	37
PID 2084 wrote to memory of 2784	2084	Bootstrapper.exe	39
PID 2084 wrote to memory of 2784	2084	Bootstrapper.exe	39
PID 2084 wrote to memory of 2784	2084	Bootstrapper.exe	39
PID 2696 wrote to memory of 2568	2696	chrome.exe	41
PID 2696 wrote to memory of 2568	2696	chrome.exe	41
PID 2696 wrote to memory of 2568	2696	chrome.exe	41
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 2508	2696	chrome.exe	42
PID 2696 wrote to memory of 1988	2696	chrome.exe	43
PID 2696 wrote to memory of 1988	2696	chrome.exe	43
PID 2696 wrote to memory of 1988	2696	chrome.exe	43
PID 2696 wrote to memory of 2600	2696	chrome.exe	44
PID 2696 wrote to memory of 2600	2696	chrome.exe	44
PID 2696 wrote to memory of 2600	2696	chrome.exe	44
PID 2696 wrote to memory of 2600	2696	chrome.exe	44

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 1124
  2⤵
  PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67f9758,0x7fef67f9768,0x7fef67f9778
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2076 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2084 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:536
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f7e7688,0x13f7e7698,0x13f7e76a8
    3⤵
    PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3740 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3712 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3192 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2580 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2540 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1152 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3196 --field-trial-handle=1388,i,12154847692188732247,9352069239719686640,131072 /prefetch:1
  2⤵
  PID:2188

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
186391585790bfb8674ff521ed737f68

SHA1
69ece33110c79707150dc59308902841a8c9954e

SHA256
7088c3ff3a9fd90811af1f41b1b64065b0d9fdd1a352f6675247a16e61bed6a3

SHA512
1ace6ab16ce82611255127df8df4f3f9324489abee8e40ce4dd141cd40da0a1095bd67d9886386878fa50594be61339a99d8e9bcec65b68994f735a14a2feaa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0192f6902cdd6868997d94169fb2764d

SHA1
d63a889dd519d45bd7f75e118a60d39468ebe12d

SHA256
d0763f9697c377d3cfeeb8ccefe2148cebd42a7ebf0875c14e0747de52048e84

SHA512
296fa21dc5be197a9f97d6be31d957b5ed54e4da35727cf34af814e4f1b944131d409cbb85ea6859855b1a1ae231ee630f84238dce3e5dff3e6e2a319085a64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38d31a1519ef2e2c40df31d000f8dd9d

SHA1
a29c66e745e3fca1cfb216d08fb6c811a6ce9b53

SHA256
a17891661685b580eeab4b3ff1472e2a41d58f91d3450b64ebd74eb2293e0364

SHA512
d3802b8550a43890c6e0d476729f4c9391b2daad30495916da0911143168d7864ffe97368defa44344ef7d597ba8a22e752599015a3a291c64ad2ccd842a9db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
293ec2ddee0d06581f67b450dce0637b

SHA1
96468fb17db6732dd2ce0de33fb405dcb810898a

SHA256
35d49a51e741811b3d611692d352796447d7a82ad6ca802a98279198d366e26f

SHA512
6ec6a2cc78852757207e37715b0dc5781df73b9f5e1b16af9377d6ce8d89089e022d215a61c27b0a4a3fa07167379d4da8670319b388e892da46fd336f0c021a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c4c8ec599103c9b114ba9dd74f43909

SHA1
a3d69bcc91a64911f143574aca52e3ae404c778d

SHA256
b708211e3e793994466cdce8d28f358b12d0cb397e664f068f0f7438b797b35b

SHA512
8e6e9ce8745a9964d000acc2ef396d9f4cc684d6f0c5e5e29687ca46320a9299fdca9b20a794600510b8c7dd9a2e56ac938e3f67a817aae1fd664a073995a832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60a2f8426d488bade3fc8c18a9eaac23

SHA1
ed64d8712de81da4704a170d47bbea2ee977d4c3

SHA256
0c6218d628ba41d6c86859d36107205dd505df727b6b9d4690ea5ea72726f140

SHA512
ac28f8e4839863ee659e572de9525bfe0188424d128bc464a45a54dd9882fc840064aaa87253ffacb8e1457aaffb22178a55e36920d3d9468e00a5b3f4024774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
670d439d5b8f2de820c78c3f54e5bd63

SHA1
2e44c90a6c06fc01565a85b6eb735a13c5b72c19

SHA256
f8c9a9aca48a28454da5ec9d3957cc73d276d61ffde930b5ac2245eb7ab57aea

SHA512
90bfce5e6251601102b00d42ea92223a6003cc032b7b841c077f2471e5b3c7e3c137e7ef7395518ab63a8f3e3c50d0fabc850d634a160295694504c3009c4c3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\92fa6236-c7d6-4548-876e-689ede6f7496.tmp

Filesize
346KB

MD5
5ecc96485415fd4a478d9af349d87bd2

SHA1
eadc8ee4bf034939e8017f6653aed5faf07dfc6a

SHA256
fa89d3cf45b9392f9b726c0271d29c9467ee587e936c036e5f9fbccee92ead93

SHA512
ddccdabbe6b0b1fdbbf5ab9a3c7293c2e0ab3079c91eab31cc3477ca0142b74f8f4edb539654dba8da655542934a8dcf07af2636d7ba81649a3dad25d9335056

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
5f4160f0d70c940cc711717ddd773257

SHA1
f5497d77c5607831c19d1d4ba4da68957471cc9a

SHA256
98e9e6d3a30c59f2511b7d1d797dfb73fce49308859def825d4e20409bf827ab

SHA512
96e8bd821ac7bf22a38b93d4da535a36996cf4af2bdfd12c31ddb3d8a1e45244a7454257eacc105278f0bcc86c0cf68d166e699dff25e55f62c0115280d943e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
dca8af5d88edea037fc325bd43f096cc

SHA1
dd66fd0c7e0551a14430d16538662e566bde176e

SHA256
1e6d8ce1646b6a0b3714483a12dd8b94970c618b21da8193b4ad264b3792cdbf

SHA512
44a1bd5ef61fee884a54d297e623fd861e7c8c204cf4a30c137781cdbcdaab7b93bd4eed915880e8ba9003c634b95cb6c5489a85996b6c5ca07cb19ad9f06b47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
50a0fb0049d250950625c8def3641bc8

SHA1
d537a66cfc3904969f51ac870754b66940da8e55

SHA256
f0125f139d9e32da5983148d326fe4af115d6e0236b4d04d4975fa53737da714

SHA512
4b7c92697ce73c5dcab74ec6b6f41971663a34e297c73e07e8e10ccc2bfc90357b4c2078ea3f34956b264e00850ad1aceec943b1ddd1482c9ccaffcddd349a0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
02068e0fdc273c8c6a0306effc17afc9

SHA1
90413c0b2648edf80909a4f3329cfba72f3294e4

SHA256
ce7394695d16668bf5fb23098fc5e96e555c0f8fbb34d9f6f3fc3dfe39962d0b

SHA512
e5248a516482dbc370ac20f0ea238854f41f50699b16e9a55ae53f3ce5b99a996f34768227b68b4a551c42018f0c1a826f6f6a335731cae8f18c8675aec3bb03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e3516150851e0fb4ea4d04c8ff322314

SHA1
fe1b56a1f333a686193642b22fe2fc166535747a

SHA256
85402f5c96d0f397c973b5ce5fd26e000c3659a74ec9640030aa95a207532828

SHA512
b1abc6b588114909e9db398c192dcc39936fdcfa9fb064ae8142d82211480f8a62b6b691f7b3e70a7b0698bd0c83832d251fc3c782f8a9a5d9b57b56279a3107

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0bd859725863bb571cb3dee407297b19

SHA1
650a449b98d7058dd33332b61ca30915cff109c3

SHA256
9be7b109de7db7797c61c434250fc0f419fea4f47b656802081bb3010fd09e54

SHA512
2480eb137a41dbf00ef6ad333ee4601caa3a75264e70e92b9b24c46ac6d2e7354f51f974f10f8d01a54aaa112c88c8f5e56badd524ee4ded860b776bc02d48d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
346KB

MD5
c15a3588825850babb26b91fe6f8a46f

SHA1
6a2f2a5d17ae1682dc0f45eedfd4cc5361116dbc

SHA256
3bebe80c40e9540a26d7eef66056e1799b53d7b92f6f885a1fd9626536921a87

SHA512
5bd3eee5fcc2337f8225edd13a28a0b39a21ad451a81d40381267d9ad67eb61e8615f1288fc55fef9f8a8cda4b6e52af1daa3da25f8ebca5f9e73e7efa7487e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
335KB

MD5
b29dd43e1e8bc0d769c96bfc83a24acd

SHA1
c33c3a18289b947b01726658670a0233b6848bc1

SHA256
a6da1987cd2b91891dc4cebd8059675ac085bdd65ac115a26e29f17dfbc76544

SHA512
b57457d603f78776b2c21f8eb3f5a700d85f84686fcde7beeac65a9c7586f7923e00799620d4a900bbb03a35fb3c3182b344cc7ffc0687ed34337ddc6a861d22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
346KB

MD5
04b29e5014a1ea05efc73585f54bcf42

SHA1
1ce63a1d7d8c04470a229d9a69cd82a414debef3

SHA256
edef5eb5fe7101e49f89a12b81880800a4c6ab5d0057a427c938ddf34353a818

SHA512
ce8e44e6b913af60a323d57081c8660afaf0e510767264013928bbf314a96f5838d75aef9b0f37dd4f4f00ebaf95899c00b538559580b0db4ef4bb3e8d8a88b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E2D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F39.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2084-3-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2084-2-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2084-0-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000000F90000-0x000000000105E000-memory.dmp

Filesize
824KB

Download