Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 21:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
scanner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
scanner.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target scanner.exe
- Size 11.6MB
- Sample260421-1mskhact9r
- SHA256 b4ae4e066b14eada8d5716aed97120fbd405eb79b92b9f45aa1983ee044623b0
- MD5 fd4206f97f9473c1b8c4c80eef0aa651
- SHA1 51541f0e74fe5edd04b6bbb870631b9008fb320c
- SHA512 b9490ac6b24f69aa01c8c5a42422e9aa598daa00c20d144971714a93a33d984eec8923832a797e41aa37f3c967b9e521f34427b533c765909279e6395d3037f2
- SSDEEP 98304:+v4JlSc6gYczkQeCfOqh/FF8dw3EHQzkCN07lAwc3KNMKUyC/WjPm89/DNurWQxk:+YZ60QQ3GC9aa0H0u7p1757jPXuFx
- TLSH T1DDC68C03EC5159E9C1AD9630CAA68213BB717C850B3263D72B60F6387F76BD06EB9354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3500 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212816065582950" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Runs regedit.exe 1 IoCs
pid Process 5288 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 1228 chrome.exe 1228 chrome.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5288 regedit.exe 968 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeDebugPrivilege 968 taskmgr.exe Token: SeSystemProfilePrivilege 968 taskmgr.exe Token: SeCreateGlobalPrivilege 968 taskmgr.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe Token: SeCreatePagefilePrivilege 1228 chrome.exe Token: SeShutdownPrivilege 1228 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 1228 chrome.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1228 wrote to memory of 4092 1228 chrome.exe 89 PID 1228 wrote to memory of 1160 1228 chrome.exe 92 PID 1228 wrote to memory of 3500 1228 chrome.exe 91 PID 1228 wrote to memory of 1160 1228 chrome.exe 92 PID 1228 wrote to memory of 540 1228 chrome.exe 93 PID 1228 wrote to memory of 540 1228 chrome.exe 93 PID 1228 wrote to memory of 2996 1228 chrome.exe 94 PID 1228 wrote to memory of 2996 1228 chrome.exe 94 PID 1228 wrote to memory of 1924 1228 chrome.exe 95 PID 1228 wrote to memory of 1924 1228 chrome.exe 95 PID 1228 wrote to memory of 5432 1228 chrome.exe 96 PID 1228 wrote to memory of 5432 1228 chrome.exe 96 PID 1228 wrote to memory of 3824 1228 chrome.exe 97 PID 1228 wrote to memory of 3824 1228 chrome.exe 97 PID 1228 wrote to memory of 964 1228 chrome.exe 102 PID 1228 wrote to memory of 3948 1228 chrome.exe 115 PID 1228 wrote to memory of 3804 1228 chrome.exe 116 PID 1228 wrote to memory of 3916 1228 chrome.exe 117 PID 1228 wrote to memory of 4640 1228 chrome.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\scanner.exe"C:\Users\Admin\AppData\Local\Temp\scanner.exe"1⤵PID:2104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9ce24c728,0x7ff9ce24c734,0x7ff9ce24c7402⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,1918824477123381600,8424670423895470204,524288 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2220 /prefetch:32⤵
- System Time Discovery
PID:3500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2743120772482192728,7093480052590451510,262144 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,11442978235647285343,16046600555977475563,524288 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2576 /prefetch:82⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,6010703244133210545,1716523146048087159,2097152 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,667332196787379677,14440688491028432073,2097152 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,10422580609411514943,13979862123726502821,2097152 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4448 /prefetch:22⤵PID:5432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,1267943857679921012,6382752731820093689,2097152 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,3001071856720760862,17534749265514950218,524288 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,11092556417185851196,1359831512454106554,524288 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5752 /prefetch:82⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,14100948290175784450,10205061699323472146,524288 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5732 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,4592592809108858244,13041587128796386384,524288 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1216,i,5960086689037577784,5188220519242007451,262144 --field-trial-handle=2144,i,1809666972560671030,4185479493624394705,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1156 /prefetch:82⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1988
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:968
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:5288
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 bd4fef975bde6eab615762e88a0f487d42efa5dc056146f84ba2d5daa7584fb8
- MD5 0193ac1e4aeedcaaa790dc1c6948b71d
- SHA1 6dffd06221fc017a9dcc301735c06e34a5fad4df
- SHA512 68c936de4c2435a8d077598be21a532458146ce0d4bb002d6a8ddcbdfe02d49790deecc1a5d6ed8e2964a07fc650870484aeab666422665c4964af8888a67a74
- TLSH T108E02B9FC961FC2B14FD1B6C70844A49E64403662B515D4F3E3E83098FB863E418686C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5f9d17cc95265fb04f7ba5a8b4fbe9e42df9a585f95e0ff0367ea2e5a8835541
- MD5 27ee4a3273d2c79ced4a30df8e3e1d87
- SHA1 6ee9d8fc506f6ca3586e4f1ddbdc731082710e38
- SHA512 cade17ca4410628dd1a2fc869259add0dd962cf4b5308aa1fc075c8a09237f8c61937db1cf5d12bc6205a21c644d0f32f48da30a1f065b5bf2ed5ef9cb726c88
- TLSH T15151ACF797E4867DC52166E49B256E2FCE7D0A28031C3C66C9D4AE4B53F2872D20138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 b8a682a0a647e4d7eb0773fcc92c240aa213b59dd8d7c3cc9211913631c2d34e
- MD5 641ba1aa2361931c519dfc072768ac35
- SHA1 cfdbb81bb7f659acd1b91c50cd7611f1d8406d7d
- SHA512 7369aa5c22abf9ced7899cb4328e8a11aa4f7eb890c4bd0735c8bb65cbefbb23a7c44829cec5eb164c18033781e2a0c0a1e7dbb92c34b8608de79ff2f67e817d
- SSDEEP 192:XR7dWAULdY+Gv7tYpAPRp2hm9CHsb+WNnEi0nhJ2JrdhVyIsnAUgtaJ:XR7dvcyhYUXem4wZ0L2J5H8
- TLSH T13D42C52EA914753B5CCBC229FD217B57D7F5102165D42E94E7FC8A2C18EB5CD221702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
- MD5 d25832a19ff9c1c57c95ef5ecf3d457d
- SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
- SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
- SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
- TLSH T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 c3e73b4733eb8356f69478e194c1eac0c34e6983ea6431151117b88c91afa3ee
- MD5 103686c9ec57f8de7170735142ca0c48
- SHA1 67af5cd2ea482f1ef486031a21a51c1bcfb6519d
- SHA512 97437a7a95cb9cfce0007b9eb556e0c6290cde41710c0169dd8be91a540b15afb025d047f053c87e7a72babd5cf75b57f69f06896e7427201eceea1d49ed42e4
- TLSH T126B012508001B552C18302B5118744DC71546F109705170293E06E71D82A1A1C024152
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58721e.TMP
- Size 96B
- SHA256 b0d3f869a4f6fdc639fb4a3d65f9ac3df4db9256e7b1dd2e461cf64893d0b814
- MD5 8df62d810b47027ff9f3365dec964a22
- SHA1 172c25ac3ede9036ca4a4e162a39263826f98b6e
- SHA512 d3a56155101f6de6825ad440df5de3091be11cb836df8fe91dc7131eabd0719adcbb9e289d1975c57a21259438f06fc4c34438f8c0737eaf0bb88dbf0966c767
- TLSH T184B02208C002A282C00303B02282C0F83020FF23C223222382E00A32EF2823288320B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 54fe34f4cb1c8f9699c3ea29a81e74e942bf10aa3dcce059b2f903883d73806c
- MD5 46e4c4d43a505c305f328f01c0089f60
- SHA1 6b2cce30c6c0adff150aac77d9043ed55214d6b6
- SHA512 7e230b61c97ad30b8b1582f1abc119369d80fbde28462d40cacb4d514c2ffc91ba218c84c4488649d2ffd838eea4586636ece2469df6edfa188a0a26f2c21d47
- SSDEEP 3072:azY9epa3xNBjF/3zGyME8Yj/ZWiJyxB3Qw/xLANk0mUW5GmRntSFCjEENQ:asiazBjBGygyyxBrOk0HOGm/SFyEES
- TLSH T1A814137ADE2719E7A47C0AA137AE150E4DAB464D306FA598A1C9630CE1D42CD0FA1F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 194KB
- SHA256 d2f425ca2d8c9a771731c502308869533844573c1e9a4406b4401d55a695672a
- MD5 6213356d2c08a8f20d4f3b1e10a27fba
- SHA1 f965f809881fa7b6333b4d21903af541bfb9aac5
- SHA512 a4f41f4e75e16c1377fb59df5046614a26267d4fabb64b387f219572642565e1d3966d41a08fc04e1fe9a85ea3826e8b0a862dbc5fc8cc604d22084e2781ae57
- SSDEEP 3072:KzY9epa3xNBjF/3zGyME8Yj/ZWiJyxB3Qw/xLANk0mUW5GmRntSFCjEENQ:KsiazBjBGygyyxBrOk0HOGm/SFyEES
- TLSH T164141279DE2759E7A4780BA1379E160E4DBA474B706EA88CA1CD6308A1D41CD0FA1E72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 555111ccd972a586894d4e991b60d5b22b4981261c72a3a20b0559b3d270e531
- MD5 17f6a3ef5fc8b7031d8077c5e6763c61
- SHA1 d166e64a111ca7e885818dbdca6bbf664bf87552
- SHA512 a570ad054731449c96110fac8a75acf63419f49cc5779bf0cf09a04546d9a2176efd47f3fc03c726ab5319efa313d44d09978d2d7c4eb12eacc26f6b71a00f04
- SSDEEP 1536:0NCcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:IC3Qw/xLANk0mUW5GmRntSFCjEEN3
- TLSH T1FD9302BA4E1A46EB957E46C176AD7808CE12130D70AFA9CC316C639D61D41C92B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 00058ee795251b324af19435d1eeec5857dd5cf279582f331b5aa326c06f8f3c
- MD5 09203d690aaa6d5c625c710a476f47fd
- SHA1 13fb97b706deab5b8cc91e545819568dee4dca53
- SHA512 5b3a58149bb2fc79fa0985eed8909bbb40dc46dd0d7818bc766cb1c8be3780610c5365455acb90b06fdaf468bba7a8b55a261f837680bd6374380668b0ce8a98
- SSDEEP 3072:PzY9epa3xNBjF/3zGyME8Yj/ZWiJyxB3Qw/xLANk0mUW5GmRntSFCjEENQ:PsiazBjBGygyyxBrOk0HOGm/SFyEES
- TLSH T1E514137ADE2719E7A47C0AA137AE150E4DAB464D306FA598A1C9730CE1D42CD0FA1F73
- MD5 SHA1 SHA512 SSDEEP TLSH