08b3baa037ff1ef979544f921e7e4f023bb649c04e7aa929b2e4328cc5ac1138

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAC/bin/fr/Microsoft.Data.Tools.Schema.Sql.resources.dll
Size

1.2MB
MD5

08aea77a547f418b126beb2cbe6e83f3
SHA1

32034ed7fef24f0e8a8a26aa23363250893942d7
SHA256

44699cd41e8e1b46cb964e39ab80ca169b8c5411b0baa40f8fb7b1aa8003d810
SHA512

07ccd46de2db4ca92c1bc42399611f443f907c24b39c6c18c89bf1df4f0c6ef9775183d682511c4cd77782c0ba93396a1a9f5a7becbec5f5af86c3c16ddcd298
SSDEEP

6144:jGG2HvMaOYCZWj2tx+yxgc3shLbl9txmyawSan2q/8EvW+P7dOok6YDX2fWyJQtK:n2HvcZ9Hr2F+E

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

39 href.li
40 href.li
41 href.li

flow	ioc
39	href.li
40	href.li
41	href.li

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

POWERPNT.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

2668 POWERPNT.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

2232 chrome.exe
2232 chrome.exe

pid	process
2668	POWERPNT.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

POWERPNT.EXE

pid process

2668 POWERPNT.EXE

pid	process
2668	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

POWERPNT.EXEchrome.exe

description	pid	process	target process
PID 2668 wrote to memory of 1976	2668	POWERPNT.EXE	splwow64.exe
PID 2668 wrote to memory of 1976	2668	POWERPNT.EXE	splwow64.exe
PID 2668 wrote to memory of 1976	2668	POWERPNT.EXE	splwow64.exe
PID 2668 wrote to memory of 1976	2668	POWERPNT.EXE	splwow64.exe
PID 2232 wrote to memory of 2128	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 2128	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 2128	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 112	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1912	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1912	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1912	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe
PID 2232 wrote to memory of 1204	2232	chrome.exe	chrome.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DAC\bin\fr\Microsoft.Data.Tools.Schema.Sql.resources.dll,#1
1⤵
PID:2176

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\StartInstall.pps"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef61c9758,0x7fef61c9768,0x7fef61c9778
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:2
2⤵
PID:112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1016 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:2
2⤵
PID:3008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2984 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:1308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3428 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:1524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2504 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:2708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3460 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3456 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3000 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2436 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2464 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1084 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:1736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2840 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:1
2⤵
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 --field-trial-handle=1212,i,11246123961974423274,7416547936407366546,131072 /prefetch:8
2⤵
PID:2480

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1400

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
363B

MD5
2f40999278d2966a94c5741126393a1d

SHA1
63a323fc0bb4ee8ae1c3fa7fcbc7484bf6452513

SHA256
fe6f0ceef3d1fdacef4354d3ca071688d495de7cc599f366bbe6501066eb8c1e

SHA512
103d2f9075ca5934383f9ba90839b3b253d86d77b128e3e09af2d6577ba0d9a81885939915478238dff33dcc5d8692b5745cb31682b2bf1f4f15027cad7df6b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
83700bd9278abea6ba6a8275d0d8b697

SHA1
8e762ef704225d1833358efc60cb3c975bc31b77

SHA256
dcd03e4712b412d766637e9ef0fc9945d5d1c7329246b94123eab3f7bbc6bfe3

SHA512
027634ef8eb5557186a2a1ebbf6924ee162292df7588ad4060fa10507e5df8f4bf9bd7722fd47f11454c5776bab59d4d697767d0ddc77ac38dcd66256928dd31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
66f67bed03ab8ee3870b95ed379aecee

SHA1
d0e1a0974c008e90d037a864aa0432f97c8edc91

SHA256
f6faf8e6940f7106a8dcbcb3345c8514397b65d4d54a589c2a1373c24c2b279b

SHA512
13cca54f9d5005790e587307fe83f8e29a9e7b2ebdb86dde100c4c665caeb791d1313944d1c420fc6d579599103d70654b62f02cd2f755813b314ae44d1a7160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c20a46feae590dae6e43449525336fa8

SHA1
5e65d62a4adb839bdf60da548ef8ccc23a866711

SHA256
e5e34f1ef53e78da9fe6ac6d8de1fcab2f5967698b7dcce2b8221d1da02f1682

SHA512
de09dcdcf8eca4873a0db7c50a692551ef1f2fffa028030e34bf07d3488488cd867e3f3dc1c118ec12260b28a4bbd572a871b430d0cacaa8d4f4294173ccb9f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
283KB

MD5
e7a83de7f5b363a06f07bd69253fb623

SHA1
989561bf2de73ef1778f40507f4810c22226b624

SHA256
03ff835befc1e0b2da118c7d0fee602c72024db0c34105899cf9335bffb724e3

SHA512
2beeb3df14895372d072503cf6b23a3f9537b6d3b07f51a84c83f5144b0540ad736f51cca4d4eb0b18778f16e06983fccc8576205ca7e02891e3ad2c98a72b8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D13.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\??\pipe\crashpad_2232_RSWVNQDGCLZJABKE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2668-0-0x000000002DDA1000-0x000000002DDA2000-memory.dmp

Filesize
4KB

Download
memory/2668-5-0x000000007223D000-0x0000000072248000-memory.dmp

Filesize
44KB

Download
memory/2668-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2668-2-0x000000007223D000-0x0000000072248000-memory.dmp

Filesize
44KB

Download
memory/2668-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download