Analysis
- user interaction
yes - max time kernel
60s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 17:16
General
- Target Madium-Bootstrapper.exe
- Size 6.9MB
- Sample260629-vtl4eaav7w
- SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 39 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 50 IoCs
- Suspicious use of FindShellTrayWindow 58 IoCs
- Suspicious use of SendNotifyMessage 46 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1540.1700.13416416007779601987 /pfhostedapp:382c6bfa761ea95915343851aa3a6121b940f3302⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView /prefetch:4 /pfhostedapp:382c6bfa761ea95915343851aa3a6121b940f330 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9ca1a5fd8,0x7ff9ca1a5fe4,0x7ff9ca1a5ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1868 --field-trial-handle=1872,i,14848528535648313177,11152394433326617146,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:382c6bfa761ea95915343851aa3a6121b940f3303⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1948 --field-trial-handle=1872,i,14848528535648313177,11152394433326617146,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:382c6bfa761ea95915343851aa3a6121b940f3303⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1872,i,14848528535648313177,11152394433326617146,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:382c6bfa761ea95915343851aa3a6121b940f3303⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{DEC6EBD4-E173-4FC4-9CAD-96FA1D62D7A5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1872,i,14848528535648313177,11152394433326617146,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:382c6bfa761ea95915343851aa3a6121b940f330 /prefetch:13⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9c6c7c728,0x7ff9c6c7c734,0x7ff9c6c7c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,14484896719085539606,12920999135288201793,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4382410882281529049,1229502241331921981,262144 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,2973711014841134385,5668096256767495766,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,13112397304949340715,612654499297520698,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,7971926528900182216,5071275468708220020,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,15431713862092947191,16826748685921081067,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,17879152882317615722,5990061576128847657,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,6613251337177649158,2631032112383876829,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,8683094203660862507,6671817801107500333,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,9572389557819861457,3194191218045138415,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4892,i,757696884973400288,14797236764421075417,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5536,i,15299574064964629051,12270502139136401076,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5688,i,17670774359094528967,3282866773876773408,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,14667895732742580603,10533893552852448518,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5988,i,14065373833016433796,6543409611328308376,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,17282247751058664792,6330785349863163636,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5828,i,5279969083280251407,13704629511981878006,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5228,i,17989780704024584326,15171214584794145256,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6108,i,9189246252887726562,3122761470278991965,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,15751485863593730230,9686686859083174088,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6376,i,15352865372880745006,15667164822509056522,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5540,i,17579294577111426250,9095542818479130164,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6388,i,16572365652693685458,5145214159408541560,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6276,i,10334198190180582701,14067252630924700692,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3720,i,7185312995161045817,780932314381140245,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,15325083208083837667,1366169072133375049,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5616,i,6153166400182392616,5919335527970160902,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3428,i,8961930332133703360,2689256168971906817,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5608,i,1504787561113470305,17561033102828943182,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5664,i,10774150454384145448,16787985817204816546,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5572,i,11366203106320745095,6954587907912182710,2097152 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3572,i,18325767411895539378,8202588164069337920,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,49886184983505328,10134624700850272415,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,3378805188843208185,335427573495341757,524288 --field-trial-handle=1940,i,17518426015786867058,13039939439929117835,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:144⤵
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
the-real-index
messages.json
craw_background.js
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
index
the-real-index
the-real-index~RFe5a978e.TMP
Local State
Local State
Local State
Local State
prep_Activatable Class_Hermes_perf.cache
settings.dat
settings.dat
settings.dat
throttle_store.dat
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe59381d.TMP
SCT Auditing Pending Reports
a5597cc1-37d4-4b44-81d8-0489d55f3d3d.tmp
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State~RFe59018d.TMP
messages.json
Madium.lnk
memory/2944-117-0x00007FF9ECA30000-0x00007FF9ECA31000-memory.dmp
memory/3472-348-0x0000021E0B370000-0x0000021E0B470000-memory.dmp
memory/3472-579-0x0000021E1E720000-0x0000021E1E820000-memory.dmp
memory/3472-347-0x0000021601900000-0x0000021601920000-memory.dmp
memory/3472-336-0x00000216001E0000-0x00000216002E0000-memory.dmp
memory/3472-337-0x00000216001E0000-0x00000216002E0000-memory.dmp
memory/3472-381-0x0000021E0B6F0000-0x0000021E0B710000-memory.dmp
memory/3472-358-0x0000021601C60000-0x0000021601C80000-memory.dmp
memory/3472-1149-0x0000021E27290000-0x0000021E27390000-memory.dmp
memory/3472-1280-0x0000021E27290000-0x0000021E27390000-memory.dmp
memory/3472-1659-0x0000021E28320000-0x0000021E28420000-memory.dmp
memory/3472-1511-0x0000021E27DB0000-0x0000021E27EB0000-memory.dmp
memory/5156-1360-0x000000000F0D0000-0x000000000F150000-memory.dmp
memory/5156-2475-0x000000000F450000-0x000000000F777000-memory.dmp
memory/5356-30-0x00007FF9ECA30000-0x00007FF9ECA31000-memory.dmp