d007a5efcbe361efbe5ec88eea8eff6191d0188e8c7111354cbb063fbac26f2c

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PeaceSetup.exe
Size 53.1MB
Sample260418-aez2hadw71
SHA256 d007a5efcbe361efbe5ec88eea8eff6191d0188e8c7111354cbb063fbac26f2c
MD5 4536c170b52023028723fd1c26da223c
SHA1 95cc675f0ed84b9d9dbd9fcd751be7230e60a775
SHA512 3dcdb777b6605dc5a3f764fe4bee2a47eda273f52adc8d9eaeb064a70adc613b55abda4c96f30ecc26a0cfa33142783e175b49c2652cf4a51c481321d092453e
SSDEEP 1572864:DA6QGBM8C1geKkUrfC47HnP1TSg0iT3ZgZ7eX+FrK:D41geKkUrfC47vyq3ZBH
TLSH
T101C7238567B1C46BC9027171E90892F011F9FDADE55F804B22743FAEBE32491DA3B936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000300000001dbfc-4.dat	autoit_exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PeaceSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209445779102540"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4872	PeaceSetup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe
2672	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2872	2672	chrome.exe	94
PID 2672 wrote to memory of 2960	2672	chrome.exe	96
PID 2672 wrote to memory of 2960	2672	chrome.exe	96
PID 2672 wrote to memory of 2132	2672	chrome.exe	97
PID 2672 wrote to memory of 3888	2672	chrome.exe	98
PID 2672 wrote to memory of 3888	2672	chrome.exe	98
PID 2672 wrote to memory of 3724	2672	chrome.exe	100
PID 2672 wrote to memory of 3148	2672	chrome.exe	101
PID 2672 wrote to memory of 3724	2672	chrome.exe	100
PID 2672 wrote to memory of 3148	2672	chrome.exe	101
PID 2672 wrote to memory of 1536	2672	chrome.exe	102
PID 2672 wrote to memory of 1536	2672	chrome.exe	102
PID 2672 wrote to memory of 764	2672	chrome.exe	103
PID 2672 wrote to memory of 764	2672	chrome.exe	103
PID 2672 wrote to memory of 2028	2672	chrome.exe	105
PID 2672 wrote to memory of 5020	2672	chrome.exe	107
PID 2672 wrote to memory of 5020	2672	chrome.exe	107
PID 2672 wrote to memory of 3748	2672	chrome.exe	108
PID 2672 wrote to memory of 3748	2672	chrome.exe	108
PID 2672 wrote to memory of 4624	2672	chrome.exe	109
PID 2672 wrote to memory of 4624	2672	chrome.exe	109
PID 2672 wrote to memory of 2888	2672	chrome.exe	110
PID 2672 wrote to memory of 4540	2672	chrome.exe	111
PID 2672 wrote to memory of 2144	2672	chrome.exe	112
PID 2672 wrote to memory of 2364	2672	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\PeaceSetup.exe
"C:\Users\Admin\AppData\Local\Temp\PeaceSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa48e6c728,0x7ffa48e6c734,0x7ffa48e6c740
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,11493308913564231000,3427054225656921356,262144 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,2552913581303642097,10893439281888277160,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,448399000241465704,16031209344405743684,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,12132057732661517605,2674948891946655190,2097152 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,7028147129923579692,1238110975554342632,2097152 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,16385560478463379832,17627605025174252033,2097152 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,15296889871279503296,2612203259113113956,2097152 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,14656253233812686691,10446994296045058214,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5724,i,16000497932572707123,4500766106142287469,2097152 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,8802328583956258446,539669763741274314,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3312,i,2309518360737461573,5819446967419126680,2097152 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,1706837295688198142,5665492201651468979,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,14512172262482634892,12417363510261807758,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,10294477363995635972,2522535295919522064,524288 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4480,i,3389596512292113413,859971254832507248,262144 --field-trial-handle=1888,i,3727252165659342108,17939772986170375941,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b4a578706a7d073e8d1baeaa62657858b375de7d9cd871fef216dfb3708d3682
MD5 26758f684b1b350cb551dce6ad9d870f
SHA1 be6791bbd2d6c0e86c3883ff0b893d39345adcca
SHA512 1fac2b611a4326f0278d5b3bbaf507fb800d39112033b90f2b0dc5967464e1fe3420846223f118ec36ac7f3e1f2675a3ba2107a6f978c44722a863d619d50962
TLSH
T17BE0E5AAC825AC371CF90B29A1050641EB50275B2781490F7B3CD10D8FB1676468292C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 63567990131d14451a2d794dc113d68107f12cf5a1cef2c9bc953c204ffbca21
MD5 1ccbd3c3e8b46f44ddebf961412a47ff
SHA1 3e60816992f1d9ad86b76d5d41b715a97e6653b9
SHA512 04f6385d5c2e0b294da4b4245ab38cc8c10092800a10f18d6d3a090ddfa4e0b93653f3a1ea1f88d9dcae7a08e119e5d2238bccc6e51e787b9fe1e264a8dc513e
TLSH
T1D281B466B2D4E761DFD0807325A13D6DAA292BC652435BDF11D811AF68F32F2304527D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b3c6797e32fd1f7cffcded993719016fc97be8df2d382d527252a966521d177b
MD5 4405b04305288183dec861a991f401a8
SHA1 514b3f810112d02e50635a610e68ca4457ac416b
SHA512 2c4ebaaee0242a04db6703bce2a151d8218478cfd40c2cef1cb6c73e5d5cae8e06614c6be1b4f62a7a033e9a9e95bb6d644589ffa631b9f9ab383c426ca918fc
SSDEEP 192:Dcbs8V7l6aIaVn24Kg1fuvyfrnI/IzKI+NMhfHjdHxArgN5:Dcbs8V7l6aIaVn24Kg1fuvyfrnI/IzKY
TLSH
T165F19FF3C3E4C52D9A1256F4EB156E2FCE290924432C3867C9E4AE5B93E2871E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 41300d0cc4fa261849cb1b30ebc1f005001721eeee3477a2335a10a55c01eddd
MD5 44e6f81dc22b5e7c516d5aa93ec75fda
SHA1 1946c2e07fe844a0e64f57c58bf66739cadc926d
SHA512 19dd75c8b99e66d3983a9068e3c19955a455b6ba3a6504a825d380e70bc1a7c9f3dcbdabaf6c93d7780f63fcca487d150a0db3588cfbf33817c5df41a90f97ea
SSDEEP 192:zRycBz16WTBss8v7rpAPRp23tZg98Hsb+WNK+P94Ko2WAhZpUwVyIsnAUgtaJ:zRymz1nJoHUXp6wvK2vh7f8
TLSH
T1AE52D52FA914697B9CD6C22AF965771BDBF2103260842EC4E7FCCA2C14D7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6726e06c42ef25445ecbdf98a7758fca4a23a258ab1925e0e347db563043bfe2
MD5 897ee9b28aff0402b52b7ea2960c85f2
SHA1 f6d6afae0a8de4a93ab528adfa9c3775e3ae1a96
SHA512 6915274c961f84447e0b517a5e4d8f6dbda4131f3254c47b14a7c56b7c3ff1fbb3036b735187ac004fa360414ba3f7733a37211bfc09f07c3d0b3845a16c31e3
SSDEEP 192:zRycBz16WTBsshZv7rpAPRp23tZmH98Hsb+WNK+P94KoDRH22AhZpUeVyIsnAUge:zRymz1nJrHUXzH6wvK52Ph7Re
TLSH
T1F952D52FA91469BB9CD6D21AF965771BDBF2103260842EC4E7FCCA2C14E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 27a042831bca39baf0438b7b19af2ff7ec419eaa22b024d97ecdeac9aea7774d
MD5 c141cf692e7573a09c866832181b17fc
SHA1 9e6adf92a5baa2ed0100e1a0aab241b0e0b75c93
SHA512 b23e31198bebf275156700df3c5d11aaf7269d8768de140f9c3f800866fc91e2e942d5f726140536755c96b5419a83ed2900182a97999dcc10e22c3a1c33be39
SSDEEP 192:zRycBz16WTBssqv7rpyPRpY3tZmH98Hsb+WNK+P94KoDRH2cAhZpUEVyIsnAUgrK:zRymz1nJmHCXpH6wvK52Bh71e
TLSH
T1B552D62FA91069BB9CD6C216F9657B1BDBF2103261942EC4E7FCCA2C14E7ACD2207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 546a1d0400e1ce0afbe818d46c03e4060de526d4fc7ed2ca34cad296f724ee1c
MD5 7598c1579306349de6a68f64938dac01
SHA1 d4fc07e496620934c3921874066186056bd6b638
SHA512 a1d463adb069270a88eaa4d99d0bd13950c0bf4fecc2ad62a01186b951a9977672c94f22756433cb20ed0eaccbd482c5e3e29f3accdf51e512a9cee7e3172fa3
TLSH
T18FB01210C0029542C14B02B411C2548CB5145F948705A70193E0A975EC271A18024160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5922e0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5922e0.TMP
Size 96B
SHA256 75068895632963fd5b4a470bacbc2a637f1a813fcdd25271c88d8f8bc8ff1d95
MD5 ea682362f90e12d89eb3530845b589e9
SHA1 a66af34b2be2a0e2704803c126f9d18482508889
SHA512 5aee1b7fef75b7692d2eca3a59d60eedbc04f2d3657ebd8f28656bea29cf4b96270e0626b7b0b715755d54e3a033e6f58a60c912b0927c6f7cd45d18db9455a1
TLSH
T165B02200C802AB33C00303B022A888C8B2A0FF28C2030202A2E00A3ACC20230C022020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 e38a703f6e3ffd18e2920a1456a445808d83fdcc399bf272b8fae1e3f7b86859
MD5 15676d2cfbb5aa05eb009d9d0e1bef63
SHA1 15587e3a33a2c8c0139b7d58f607f645e08b26e9
SHA512 93fc67dc14a8541bfac384e03139f5c173ad2bca0df375af692c36828adcbcae4e2e00ff518253ef65c14ff8d58d538f722f43f7eae1ebbe52f43b24004d037a
SSDEEP 3072:rn+Eh5Jp0AMNqd6f7ID9KiomJicv3Qw/xLANk0mUW5GmRntSFCjEENf:rnD907cM6wizJtrOk0HOGm/SFyEEV
TLSH
T15714136A2C1BDCFB27AF0592712D6B0BC962375D30AEC58A33446B7F51CA0853776E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 13a831495ab00b049f2964af1c5f8472cc2d1f596965b70902bd094b010b1598
MD5 3c53eaaf39af0eed0b5b5b653aaa4352
SHA1 1df927f41e747b74e95c4ea179b65a30d0dc4e05
SHA512 d02c72420f53403e7618e457803f9d6b89e782a1b08187d2cf77771c00f7929fb1974813d96baef8cb008df98eb90999b5f47d8a739aee8bc21ab83f4eceaaa1
SSDEEP 3072:Qn+Eh5Jp0AMNqd6f7ID9KiomJicv3Qw/xLANk0mUW5GmRntSFCjEENf:QnD907cM6wizJtrOk0HOGm/SFyEEV
TLSH
T1911412792C179CB71ABF0692726D6B0BCD62375F70ADC48933486A6F51CA0847B36E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 f753783a12053b96d00282a068b51c2d272af8ae8ccb3d5fcb527544cfc9e2b2
MD5 530555577f929cccbe8de64ccefc3cbe
SHA1 78fcc076af18732403da4029b9f9cb301df1534a
SHA512 90e8112f8626697cbb9a1925ca8b8955dad81b438272f7967333ccd2617429d5b001972944b32c1f8a65fd48944b05b41e1d4ca4d8c41075e23db4305055e0d4
SSDEEP 3072:mn+Eh5Jp0AMNqd6f7ID9KiomJicv3Qw/xLANk0mUW5GmRntSFCjEENf:mnD907cM6wizJtrOk0HOGm/SFyEEV
TLSH
T18D14136A2C1BDCFB27AF0592712D6B0BC962375D30AEC58A33446B7F51CA0853776E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 7e93f0d3f6afbb037aa34fe5fca4cec8a50bf4a6d47e232eb5e54aa86fac5762
MD5 ef4cc0e857a6b340b64a46f473e67e9e
SHA1 2e9a29dfba86f295ef550e8bea9fbf7f09fbdda0
SHA512 8e2303bb86584443d0b31f21c2a0d91258c15c1a3551c2c45f170859a181bd90b61065e56a82f396d9a0c9cfacd8c7847c5c66427832cf51654b129a490bbf3d
SSDEEP 1536:g8cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:h3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1409302BA5E2A4AE7957E469176AE7809CE12134D709FA8CC316C639C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peace.chm

Path C:\Users\Admin\AppData\Local\Temp\Peace.chm
Size 649KB
SHA256 6b8de5a72c1057f37768f487fff7e21d30e1faf36ca82a25f707adcd4e6ff3cc
MD5 0560a9672c723ed7817f7e223970e605
SHA1 990d611631c77565b573b426170b9e25a494b8e2
SHA512 2db2b33473a6a73982f7dcb58f3f7ebff7fe1ffdf45fe680f52f2e17587bd61a5022446c15062ad0a30f1679aa63744f85bdae07cbfd2f6a59d5acbc7a110422
SSDEEP 12288:w2VmIMJPAXxu/v9gSUwMV7r4Z7jLJ4WNOZd7/wfh2JFs9AIBe7p:wkaSYXXb51SWCd7Cus107p
TLSH
T1F6E4235BCDB0FAD2D19E0EB8BE994F745D0921531E84931FE27C2F610EE1BBC8915684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YouTube.png

Path C:\Users\Admin\AppData\Local\Temp\YouTube.png
Size 1KB
SHA256 a93a425b641c1dfbf83addfeaf1e7438d571cb49ce617ba863c1c9b1b8b36c27
MD5 e475abb25afd7b4b9fff2b0a40a7dab1
SHA1 70ecf5241076808be3241f24b58b927fdc8cb468
SHA512 3b717580a89cba780c8172af28faece249500450680000159983f81a38cbc72e2d1b89663551c70d6adc2433b22fba33725aeeec5b27c8d54c43bfa0347bba57
TLSH
T19A41EAF92E1D207C2D84E961AA019D5064FF9243C653E78F926F276AB04141858DB7B2
MD5 SHA1 SHA512 TLSH

Submit Download

arrow.png

Path C:\Users\Admin\AppData\Local\Temp\arrow.png
Size 574B
SHA256 3e4a7dab25f24d23f3cbbfa55d2d033d4f92cfb8ff911fb9bb1aa6e12c16e69c
MD5 735f5e92b74c67eda5184bbc44879cc3
SHA1 4a2ae1a7b39335c4bdcd133611e964b214ccbc18
SHA512 5f2baceb0e3a02f22b08fd2bd7446f439672080ef85136e5ac23cd5718f683304b12a38320c196c0209faec4c0e4f6c8e427e775aabfa5fa7fb78b5506e9fe58
TLSH
T105F04183BF80DF15F2CC3323C96EA4FB8A12D45D00431380221294650CF9A56C1B6AE3
MD5 SHA1 SHA512 TLSH

Submit Download

aut5D3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut5D3E.tmp
Size 24.2MB
SHA256 7b52db74575e7cb59a2fa03d2d79b86f0a5c3ca04178bd216095bee74cf28021
MD5 114e835908dc6adf5b32b6caaac16fbc
SHA1 e95c2dfc5757d1b1f0e7208afc32b35b7e791ffc
SHA512 81180d2ab20fd89f281aeca36efe6d1f3f865d55e859d469b5db916341cdf07bce3782a0402292e2c33aff591d8edd56379aea3c313e9886ce6dd17a45621692
SSDEEP 393216:z5Xu4TSbFAurEbJ8V3FvAVtPCVTgBPlneErTYSKY3Q1FY6MgpfzotfArXCETbGux:lXlTSbfrEb4vi8SexSpglMgZ+obC2
TLSH
T16847235267C5C8ABC5027172D501A6F166BDADFCE627810B21783E7EBE710A0DF3B225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.png

Path C:\Users\Admin\AppData\Local\Temp\download.png
Size 459B
SHA256 b1940b89f14666a26330f483b8af2a549b3d5d313c6edc2bd38e8f3f1bf47481
MD5 f355635b69fd5227ff80925ac6c6bd60
SHA1 42f2757798093ae40ef4392798589c0eafe93e6d
SHA512 187b701c112c69ec3ab1fc0bc330d3b6c71bdc34c829ed749d209b153935c15746b2aba7c6ebf900154b275d1c6441a33d6a00e53e597eca673a8aefde185964
TLSH
T113F054E2B1719F8581DC24F3027F3578A032C2481281292A0657546FC60C60804F0B4B
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Temp\icon.png
Size 13KB
SHA256 dd1c8ed88d87fdddcbc01e17f5319f6e13a07394d646bff33cb21497eafb62c1
MD5 cdad8a6c45e0288f0c3982aca99d7d69
SHA1 07761e53bad50b9a314689437e94c61d6e4922a6
SHA512 5c50963eb55e53ed552bdd2c53f350b6ec1cb6e9d798d0731fe9ffe7bb50e720a1756eaa49a52343279f23574899c8d63bce71d0ef3bb05b8c57000a866e4580
SSDEEP 96:MCeNqn/kct5wat2wrqbWnQ/9Y8HrttC3QcAUR48Fx2qiSa7ovROnn2ZWL:M1NmkSMyQ1Y8JtC3QcAQc+aE582K
TLSH
T1F752F750B042F4A4D3896936DF90C1FD27627D0E468AD807B4FDBEAF7FD928708156A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icontiny.png

Path C:\Users\Admin\AppData\Local\Temp\icontiny.png
Size 833B
SHA256 e68391f5fa3ca80194e4927c1e6cae96770b57483073298dc84dfe3078657773
MD5 f1fd349b745a1c957430d12dacdac561
SHA1 a8e9cf6e7c5cb6c0e8f51f8ce8bb9e92c77d2732
SHA512 8e935cb92e2186231ecc312430e176bc76e72c37d080db10d51aa873afdc7780abbb5e96a047b088f0cb203ce3531d94a0d95cb9ccbcc207988be6ca3c4e4cbe
TLSH
T1D601DADB73B54F5178CE18A217509D44ED653355A2EF330851441BE5258096363A9703
MD5 SHA1 SHA512 TLSH

Submit Download

questionmark.png

Path C:\Users\Admin\AppData\Local\Temp\questionmark.png
Size 522B
SHA256 ecd3aaf4960e067f0cc07b4783eb9257218e5f780eea59fa08951f14dda00b34
MD5 7be8946e99ece93018a7cfa891a77e1c
SHA1 a0b91fd784827a8288f20d5140daaaecb1552d81
SHA512 c953ae0cfe20ed82cb25047266dc355903b80622eef1e91d24ff0fd931f0e325131539d107c0896e6ff10963d9eb8251f99c4d4656d94a1c391df24a2571d10c
TLSH
T159F020ABB9230DB8C68D803925031168C21A92F9C992258D03828135F51B526C968A03
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4872-389-0x0000000005B80000-0x0000000005CA0000-memory.dmp

Download

memory/4872-474-0x0000000005B80000-0x0000000005CA0000-memory.dmp

Download