3a381567de16f8bcaae28c09add9ac4703f09666d57e73325b06ca5288a46a89

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/06/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bootstrapper-x9.9.4.zip
Size 4.3MB
Sample260624-tyhfcadv71
SHA256 3a381567de16f8bcaae28c09add9ac4703f09666d57e73325b06ca5288a46a89
MD5 fb8b6980b0c0d141b5b889a1fd311a3f
SHA1 94aa0307e2f7379454f988fb9b3de8641ef21896
SHA512 357949999354933ec6b2dded40506dc131d308ef284f552b8128488a46e44e8b4073473314292ff5184b14ff39d699042ca19443aa785a04d2948593d14da735
SSDEEP 98304:Kk3dJGo0PtA01qdCmpiUJoxGEHcpVT4BNzZt/2G63DUusKQTlTkf0:tPh0Zm5kH2KnH/d6zVsK2hkM
TLSH
T19826330B3F441B95E9308E38921940A48F7C6F76D28471605FB9A685CCA2D8F76F9B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267920880682456"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5024	5236	chrome.exe	81
PID 5236 wrote to memory of 3444	5236	chrome.exe	82
PID 5236 wrote to memory of 3444	5236	chrome.exe	82
PID 5236 wrote to memory of 5000	5236	chrome.exe	83
PID 5236 wrote to memory of 1628	5236	chrome.exe	84
PID 5236 wrote to memory of 1628	5236	chrome.exe	84
PID 5236 wrote to memory of 1072	5236	chrome.exe	85
PID 5236 wrote to memory of 1072	5236	chrome.exe	85
PID 5236 wrote to memory of 1964	5236	chrome.exe	86
PID 5236 wrote to memory of 1964	5236	chrome.exe	86
PID 5236 wrote to memory of 1696	5236	chrome.exe	87
PID 5236 wrote to memory of 1696	5236	chrome.exe	87
PID 5236 wrote to memory of 5028	5236	chrome.exe	90
PID 5236 wrote to memory of 5028	5236	chrome.exe	90
PID 5236 wrote to memory of 2064	5236	chrome.exe	91
PID 5236 wrote to memory of 2064	5236	chrome.exe	91
PID 5236 wrote to memory of 2120	5236	chrome.exe	92
PID 5236 wrote to memory of 2120	5236	chrome.exe	92
PID 5236 wrote to memory of 1788	5236	chrome.exe	93
PID 5236 wrote to memory of 2276	5236	chrome.exe	95
PID 5236 wrote to memory of 2276	5236	chrome.exe	95
PID 5236 wrote to memory of 3064	5236	chrome.exe	96
PID 5236 wrote to memory of 3064	5236	chrome.exe	96
PID 5236 wrote to memory of 4268	5236	chrome.exe	97
PID 5236 wrote to memory of 4268	5236	chrome.exe	97
PID 5236 wrote to memory of 2872	5236	chrome.exe	98
PID 5236 wrote to memory of 2448	5236	chrome.exe	99
PID 5236 wrote to memory of 5140	5236	chrome.exe	100
PID 5236 wrote to memory of 4944	5236	chrome.exe	101

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Bootstrapper-x9.9.4.zip
1⤵
PID:904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe71c728,0x7ffcfe71c734,0x7ffcfe71c740
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,15840640952245711547,3496966394808934568,262144 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,6735700094586987605,4476847487775841699,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,12917434273947598876,12465240118210922050,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,15007583035405373835,4766156688727360365,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,15541593156778246188,3920858732386304040,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,5636379327729911694,3503298426568450718,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,5095759161347926271,781218621234152737,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,5625375550377283302,3352179117662165138,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,7060747562588835921,11433305572615688708,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,12281790131146816811,14304381268777810377,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5744,i,7970639901950713230,8612088866647170427,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3248,i,16744092454536383108,1494059655001349890,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3612,i,16598762134259317800,149679103537702222,2097152 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,14774233270425642432,13848065037097457512,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3664,i,8607068838549626386,4949411587932742315,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,9978393051017592845,3645587402597411922,524288 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5712,i,5349877002683395626,3181695658335545884,262144 --field-trial-handle=1984,i,3440699397281749344,11233014758803538038,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:10
  2⤵
  PID:4944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6891f457-f81d-4db1-a6dc-da968e34f888.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6891f457-f81d-4db1-a6dc-da968e34f888.tmp
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5c5236135351fe661db02b0150c5bd1b71148a5ab309a17f853b71f3abeb6d83
MD5 3c7399a538c0525912cc4b5c4aa6e230
SHA1 ecfb109bb2454fa45475a6df495765c3c729c2a6
SHA512 f972a02c0cdd2d8df5e2313f3aff22ea858936e6b65b0c002d8d502f1c0a7fc7c8e092e4f17ed7c8ebf18b8da7c875529da493512c5644610fbe04685404063f
TLSH
T145E02BAAC921DC771EFD5B2C71954345E76013173B815A0B3B3D910C8FB1B3A414581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4c2a1dbdc5f0e6a935189e942bcbb727f593a692787818a9b7b3dfa215f404dd
MD5 aceffc5eca5816a250fc78aa7568fe2c
SHA1 d3d2fc69ad184db5cb192229150926d4378bb5e4
SHA512 6e32dc3e3bcf64718d1848a76b7aaddbad7b957328ef0a604d9cee37cf15e934d0a08271128e3db8d97f2aab23ad16078835e37379f3b7abee6e02dd4b096617
TLSH
T16011B85404F31523FFB89D3192EE4984DB238DA835CE3316275808482C13EB03038DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c55d595ff85a8dc0a96e2a8eddd3b7f20e465e5a5891873950eb91f94ebe0b4b
MD5 3d1825767da25baeb4fb312569f384fc
SHA1 c97a87426d27339ab4339d90d0eefc936f3db590
SHA512 377cc5addb2b333ad90212d6c77e130d351ad89f78bf942f60bb2a887af065b3b2449b4594b38f601f6e4c2148c15721118de4d71776d918af64d22fd47e05c6
SSDEEP 192:DKfl5ZvJRYaIUbM+uczWpP3NPgaPWJvafP6kyslDVRpRkfGgycPMX:DKfl5ZvJRYaIUbM+uczWpP3NIaOJifSu
TLSH
T190029EF7C3D8856DC80196F4AB256F1FCE2A0A58532C3C66C9D4AF0F93E2972D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 bd087fe483892c452d358e8a421847c89e9e14deb122d4d3f9e71f9c4113a6fd
MD5 386ecaa0955c4045ff5d3564884579cf
SHA1 f300ca030ea1207216dc0f0fad4119a90d796839
SHA512 f6b530e77c1b3bdb17c9d9a9e73a16b995c3bdd3b8aaa5ad05c31ff9408ef713eb2a25301d7b43f44dd066b7bc072616c3e68f816c07abd38106bff1dc854f7c
SSDEEP 192:DKfl5ZvJpaIUbM+uczWpP3NPgaPWJvafP6kyslDVRLHRE:DKfl5ZvJpaIUbM+uczWpP3NIaOJifSk+
TLSH
T11BE1B0F7D3D8856DC80196F4AB256F1FCE2A0A58531C3C66C9D8AF0F93E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bee654f1af2069a0a509c1f035f211a6333170ffb8309087a15bf236681873a9
MD5 5825f2b4fa012244eaba2998fd14685d
SHA1 25189db5ea4c1ca363f6044ba8334d3cb887c38d
SHA512 0cdd5d0a9d69d6b56abcf9e3f578d00a25461711dcd6af71ec6dc59bd777aa42c14425cb0935667b09d30627306d052c3b5341424f3634a2fdcd02b27a6b5fd0
SSDEEP 192:SR/cBzlvGcNqEsv7HhAPRp2T/o9DHsb+WNnBB7p52PS4FkYeFWVyIsnAUgtaJ:SR/mzlH4j8XV5w/b2DFkYew8
TLSH
T1BA52D82EBA146A3B6DDBD619F9A57B67E7F5102231D41D84A6F88A1C04E79DC321300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6cfdbc38360e50dd552d7de72b8c8d9257320b8dd593847f5995559b392fb2cb
MD5 e5297a70b7bde05e94b2b0fa9513115e
SHA1 6d79fe133696ab646a4d3190984f1aeefa987f2c
SHA512 9948f8d40d66777096aef25fc096d9aefb6ce084d6a52fd63db865f5dd606940af14efa21a14507e4dc523c078530dd9d0fb62ca561e8d663e3181c9d27c31d3
SSDEEP 192:SR/cBzlvGcNqEvv7HhAPRp2T/Tr9DHsb+WN6ABB7p52PS4FkYeFWVyIsnAUgtaJ:SR/mzlHnj8XA5wPb2DFkYew8
TLSH
T19C52E82EBB146A7B5DDBD619F9A17B67E7F5102231D41E84A6FC8A1C04E79DC321300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1ac9c210010ec0fce0e78cb67b90aee3872d26c8547463a069ae7d9ef04fbcce
MD5 9fe6c589012f72a17fdb40793466e73a
SHA1 745894dc700706f5afdcb928c69a03712ff630aa
SHA512 d09edef67ee551e35352ceefc136d0b3e3a0c285f30448d772269d4d83cc514b9a3b6b77b0b0123e70a89e46f76b348f9ae541cae048e221788eff8fc9ebc643
SSDEEP 192:SR/cBzlvGcNqEwv7HhAPRp2T/Tr9DHsb+WN6ABB7p52FS4FkYeF0VyIsnAUgraJ:SR/mzlHsj8XA5wPb2RFkYeWe
TLSH
T1B052E82FBA146A7B6DDBD619F9A17B67E7F5102231D01E84A6FC8A1C14E79DC321300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 47d52fb42fd1d94b974120bd28c3cc5a7d4ffdb5c60ac0e1a88bc7100ec8856c
MD5 6d6c5be73337f85a08be6820779e89f8
SHA1 1d2e06ba617175cf9144fe9aa3b301e27e602315
SHA512 d546232f8b4583fd8d1d1c0c1f135f03af781457cf6e0e124834b37844f2b7ba1295a8b76e6fcf47524c4eef13c06d1afdee2035f69b2c6fe6b895ed231752c3
TLSH
T190B012408042E101C01A03F421422888B11C9F10960E2B0583E0AD238835153C529052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5860b9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5860b9.TMP
Size 120B
SHA256 020204cabe35495eb6b7f0975588993eea01f5ef15e3637e69cad16b9c816030
MD5 c772d65cac70940dd340484f80b10185
SHA1 6c02b0602c0039dab817cefef9e02c24753ee392
SHA512 fea5104c50009597b349a17b88620976d8181596a6f73cd7cdcc7628c7d659093eedac9f40688783e99362894143d355f604954d2a58bed646f6e1ffbf4de9b5
TLSH
T122B01221C081A251C40546BC2D54848C3204FF10C503070376F467029E355501D18150
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 22fe36cf9d5714defb23c47a4b0b7a908398888840a0e01ba82d4f6fb4646bf7
MD5 81086270c4cc587b459de6ac1899f5ad
SHA1 0bc0d177133e076b344c4bc26d29b628ea88c23d
SHA512 cba173b2ac49b9eaea01063ac146e20d4cbb8a513d01cf4b37bf16c19c4e6f0e7dde1f9cd11c19e2e5b387d605a56eaf891a70d4e43adb4594dc3d8b15316033
SSDEEP 6144:eyGLlhO7emRrSbryFOZtdXMm7Rkm1tYpBeh2BAoP:tGLlw7houFOZLP9oBGcAoP
TLSH
T1353412376D713B7769B6AB399843171B2DF18EA78925EA9AC1CC0F0453EE7C90D06438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a14924db741517bf8f382e3c33999a15ba990f6191d4bc4dd0b17f57219f8f5c
MD5 b809001cbeb59ac2ec915d98ae95e9d4
SHA1 0216ce7a16779c0adb8447e3543f79c0b24416c0
SHA512 76ef32fcd1dc7cf9988b1234eb6dc67a93103b9f8b3fe9640e56152993b677e17ba1af6ab17a52085f1d5f5d5aba74241d3f3071c2e6f20a291b09918e030c37
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Rm7Rkm1tYpBeh2BAo+
TLSH
T166C3122B5D71A93659B5B74EB08D0B1F1EF14DA6D930DE82C8D85B0477FA7CC0A05A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 c6cd6aa7e9550901138a367cd5f4aeb31e14f77be6eaee55391affa9fadb08c9
MD5 4773ecbb778ea285f64d73455ec63a7f
SHA1 cf6a341ff24dcc2cf16ee86fe8e24516a2bbca69
SHA512 244811eae998abb70bfd6e5ebe73619eb9122d0f4eca91d7207a46e29e83b0bc19bcb64acc14a7a4fe4ce9a8274815560b4063c36af9f65e5f8a5ee88f4837be
SSDEEP 6144:JGLlhO7emRrSbryFOZtdXMm7Rkm1tYpBeh2BAoP:JGLlw7houFOZLP9oBGcAoP
TLSH
T1C83422276D702B7B6966AB29A8930B1F2EF14DE68925EA97C2C80F0453ED7C90905538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download