6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
183s
max time network
185s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
22/11/2025, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/Illuminati.exe
Size 1.1MB
Sample251122-vb6ebsbk51
SHA256 f99e4c9a4dd14d402b16e36988b72f3fe7f34b42157f756dbd14b39c70059336
MD5 087b2505ac41831c753cf7d1e660c42c
SHA1 dcae226923e062291f48de4d3416d38387815c67
SHA512 10d5f6f7c9f1df66a7afd3dcd2e70288d89bb75a2f6fffa3621b4a4192c40b290eb7c76392b0b282d80925b81d2271c3d1e96a4f406d1f1c0d069a5f6f96c086
SSDEEP 24576:qqvM7STjLT5MSLMDPS2X0xCyj8pk3tgqdtKkkoMJJck:VwMfTvcS2kjPgUGfJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral12/memory/972-0-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-2-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-3-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-4-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-5-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-6-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-7-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-8-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-9-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-10-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-11-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-12-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-13-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-14-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-15-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-16-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-17-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-18-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-60-0x00000000000C0000-0x0000000000468000-memory.dmp	upx
behavioral12/memory/972-324-0x00000000000C0000-0x0000000000468000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Illuminati.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083040890448430"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
972	Illuminati.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: 33	2808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2808	AUDIODG.EXE
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2748	5104	chrome.exe	80
PID 5104 wrote to memory of 2748	5104	chrome.exe	80
PID 3168 wrote to memory of 2208	3168	chrome.exe	82
PID 3168 wrote to memory of 2208	3168	chrome.exe	82
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 5152	5104	chrome.exe	83
PID 5104 wrote to memory of 3716	5104	chrome.exe	84
PID 5104 wrote to memory of 3716	5104	chrome.exe	84
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85
PID 5104 wrote to memory of 2236	5104	chrome.exe	85

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Illuminati.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Illuminati.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f2ccdcf8,0x7ff9f2ccdd04,0x7ff9f2ccdd10
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1944,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2192,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3504,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4368,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4544,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5284,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5224,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5532,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5384,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5600,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5940,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5968,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --field-trial-handle=5876,i,18131919881659588268,3476252064881486066,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5852 /prefetch:12
  2⤵
  PID:5136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f2ccdcf8,0x7ff9f2ccdd04,0x7ff9f2ccdd10
  2⤵
  PID:2208

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f874de81569dfe7316b71b33677f6399c683c8b0882549ab8d719d46b8ac7ae4
MD5 d03e4781882bafb73de867ef7de3e349
SHA1 106d9f489945a645f57c635e0f10e88745e377ec
SHA512 1d0a28596525ae0ec2777494105913354c5db360a372e4b35ed88a2971618a4ba3fccd6d56dfbf4704c8711e218893e014389ac816c94f8c6c3612aece812466
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f1b28137938a2ec042c30c1333b99eb4ead8fd005d5f92628846745e1e22edf3
MD5 89791c9b6fc0779e66d77193e40ce3e0
SHA1 d43268b73a4a5b9c614d0433dd3ce1ed885091d3
SHA512 bc5ea23019a48026a8c2fed2e89c6d787098ae5c87e67c4842daafb4d598d5919056aab91ab9ed4997fff554de188bbec6df120c7e9736bc4c340dfbcfec23fb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 73922211a5898cad85b39ba8c64d420c04986dff4bf0ec4795e77faaa734a716
MD5 9e61fe4e8368fc61173108714bb489c3
SHA1 c0a51d4e15dc951548c5c458925ee83be3806d93
SHA512 b5ce8243b36db5646ddaf971343758614f8dc37f9289e77cc43796dc9878781d054d158be2df664ca38a3b4e6644fd5129c76313be1866dbbbea6877a9801756
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a969738e0b2b788d4cfe6c9706be176abaa1bea79b31454c225f566b78ca016f
MD5 8864293e20e4012898821e4c352350bf
SHA1 bf565dec4b5eb2222b500d286ae3f8b8aa4503c5
SHA512 159c6f6d9cae83c42ed0485bdfcdf3a920a4b366414e38e606bce7c018024c788f83e3263ba1ea3c5bbeeffaba4261758ccfcb28f602cb93423506c01bd06b91
SSDEEP 48:YALl2n52x9ZzLsXgCzsa7savsj8sw3us4tsofcKs7hsllzsYUsZvFsXVsHIsayYa:Dmo/aZnyeSXsGPlIQqXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4c3cbe64ce0d5a92a0708147bb520f64aae44beda8607f86138d2b40a30406c8
MD5 85ff0f9f40f4176c2e0d23b96b725ba5
SHA1 b0b18501af4b1ccd12ecd21ef32ddd661abfe809
SHA512 12c5ea6cb4f62528434180f1f3340a68b0909ba6c825d0fa4e1f976fa7af1f301cbe41b94f3afc30f5c31d3825bc7b3645b020b6971bc231e9b5c0206ca4820d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6b128b0bf6ef02c3afa3ebff345f19dd115190ce938a1a53850c4254db58cc4e
MD5 7109e9c1fa612026c70593baff4a229f
SHA1 a598d7415afcc9c20504ea1cc2424c8026a292e0
SHA512 9a0a5aa648f12f539fa1243aab5f35a4395909eee5129d8700a971dae02539469bcc61b3aa327ee74793d307ab5656cab9d32b6299ee4d102361294141d687e2
SSDEEP 192:VYHcBzAjhTRQ6Z8PRprmfI9CHS+WN4VNBPL+JzPA23ecVbpQyIsnA/g4:VYHmzA1iXhQcUJ+xPA2rZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f8633fc43f32672dccbcca5064d68912285a4cfb73b70595d709132e43801cc0
MD5 84ad13db18bfff78350010970b8ce848
SHA1 1787c9399e50452753e9bd8e57f60c21cb3e8ffa
SHA512 9693f71c5e9d4d892823e44c9bc45490f36a1ca8a79ab2cca4ffd3e4d95978df9ca4c0a1fc46efdbab96b167ec4d3f51be11dc14547f4970070f2932ca9b0a64
SSDEEP 192:VYlrcBzAjhTRQ6Z8PRprmfI9CHS+WNqjVNBPL+wzPA23ecViTQyIsnA/g4:VYlrmzA1iXhQcAJ+IPA2IZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 ad45964bdb5bb34b41a2295aae550645822d870c6fc1811644900dae555ceaf6
MD5 276e4d758c79ac83c774f50638996a00
SHA1 4cd3031e94858eeb16acea5ecd880a7f07cd0b27
SHA512 6f5caddbdbb278c9b160870ab58b8a653453eb2fb9d89cdd8d22b1e71ef6343b7d822c4741a824e4c90fe9ec50605503a37c7c2ab69141c7e2b4aa7f773710a5
SSDEEP 384:koJj7pLuLc5b7pLuLco9cZX2bPkXqKf/pUZNCgVLH2Hf1oJrUJPHGVwDGaKlK4:k8j7pLuLab7pLuLhm92bPkXqKf/pUZNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4de233f2c5692fb2f3a59ac8005db3762211a1db4e85c3855c718eeb5ed72347
MD5 a72c7652292ec4236c68c70e0e20544c
SHA1 651ae360ccf08934d2cdb29c8303789a187a7c71
SHA512 e5a758cf34627f2c1f96ec92e99d7d04654f75769458b5bc8dfb040e5144f9483c856a249e84d1c9abdec1fc498db8b54e69feec9c04130748aa197bf4b462ea
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5a15bc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a15bc.TMP
Size 48B
SHA256 b6298297fb4afdf62359bc9448b8fb2de6f75d4ffa1ed0c92cbe33953f563acb
MD5 6c4da847d4403642f5f6b02b4113b00e
SHA1 0310c27b6013262bc3431cb33c28b857825eb21a
SHA512 80b56934c5a321a318b80c01058230e13a0c54e09ead5c71927871185d24e477bbe57728fae658e290ff203c508e32f11ad09cd6436b1452e015d0b1608f01d7
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 ffa39b715ea3eba3c8bd9c3553344c6d0677772444b3fcc3143a0753de847179
MD5 e04f3ce9b00ec86988c1740726604dec
SHA1 af3aa109ebc06684ffbd51c568ea504d1b66179e
SHA512 65074b98e57e6c6ae7e7ed1138fa9ce5da5a6c966aed5f30c27bea315636199f4d3a4a880840e0ab2a13478832fd5bb5c9026046497b0ae0326f3c895909832b
SSDEEP 6144:sd8YtRCzomLVyVXTkboPFEyWMExki2KL64sbWRtHqldg+G/MI:sd8IRC5yVXTkbBAYkEsbWqldq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 43ad4fd1761793a86c3f2e4988c18fc3f8813e36e34aabb5c320e310ab858c61
MD5 aa1d84bba60ab1b7568d18c279f45641
SHA1 7515fa80bb97c5697305148d92df2aba70aa177b
SHA512 0dd08c211825c6768b59126cc034c9dd4f147f8736f76befb3b655779d422cc69f7b2755ac9cb010969eb640f0f5027255e09d5603ddd22d315150d6f6a5fe4a
SSDEEP 3072:pwXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cTI:pwWMExki2KL64sbWRtHqldg+G/MI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 aae98390e82ae008fadadaf483b4d4c55ae7143f58cf7c2f21ae6d256413f38a
MD5 e799f8977d7fed4debb3996223172a6d
SHA1 6702c4594e2e9b21bd812f98d628dbe6f9dc1257
SHA512 a4ae2ee775aa4a6dd555125d5e9e54a4c16696c4daeb6388a36afde830b2323ade6f1d1f1b5e60bf65dbe6c6c8a7bda22f57253b7b924e3d7965e810c619b19a
SSDEEP 6144:sR8YtRCzomLVyVXTkboPFEyWMExki2KL64sbWRtHqldg+G/MI:sR8IRC5yVXTkbBAYkEsbWqldq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

31232bfb-7425-4129-9f36-62d13dad8082.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5104_2122210512\31232bfb-7425-4129-9f36-62d13dad8082.tmp
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/972-9-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-0-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-17-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-16-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-15-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-14-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-60-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-13-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-12-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-11-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-10-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-18-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-324-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-8-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-7-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-6-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-5-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-4-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-3-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-2-0x00000000000C0000-0x0000000000468000-memory.dmp

Download

memory/972-1-0x0000000000467000-0x0000000000468000-memory.dmp

Download