eb0e36a2c5760234b5536d2174ffa6414dc7ac42418e7e63d75e8a5728e05919

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YBClicker.exe
Size 344KB
Sample260511-yfbbjacy9m
SHA256 eb0e36a2c5760234b5536d2174ffa6414dc7ac42418e7e63d75e8a5728e05919
MD5 8da6525be94ff9a2b6f276f92d41c48a
SHA1 eedf297a07da2e62c687671ac2ee5bb765671020
SHA512 cdfbadfdafab745f2fdcc55dfd53f1cd429f47d8951d6856452b78c952c1d0bd225e76a1ff90a80f193f7a3d1b3f2476d4e7084b1528a27de10de263982c297c
SSDEEP 6144:S7CDSSsE+aDk4onVTfw3xiDA9ytVwbc0WW7:S7mSSv1y83wA4Z0WW
TLSH
T167749D15F3A510F9E1679238C9928905E7B27C864361D7CB23E04A9B3F277E09E3E791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230022914100674"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe
Token: SeShutdownPrivilege	2156	chrome.exe
Token: SeCreatePagefilePrivilege	2156	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe
2156	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3036	YBClicker.exe
3036	YBClicker.exe
3036	YBClicker.exe
3036	YBClicker.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2672	1800	chrome.exe	96
PID 2156 wrote to memory of 1552	2156	chrome.exe	97
PID 2156 wrote to memory of 4652	2156	chrome.exe	99
PID 2156 wrote to memory of 756	2156	chrome.exe	100
PID 2156 wrote to memory of 756	2156	chrome.exe	100
PID 2156 wrote to memory of 4168	2156	chrome.exe	101
PID 2156 wrote to memory of 4168	2156	chrome.exe	101
PID 2156 wrote to memory of 464	2156	chrome.exe	102
PID 2156 wrote to memory of 464	2156	chrome.exe	102
PID 2156 wrote to memory of 1180	2156	chrome.exe	103
PID 2156 wrote to memory of 1180	2156	chrome.exe	103
PID 2156 wrote to memory of 4392	2156	chrome.exe	104
PID 2156 wrote to memory of 4392	2156	chrome.exe	104
PID 2156 wrote to memory of 1184	2156	chrome.exe	105
PID 2156 wrote to memory of 1184	2156	chrome.exe	105
PID 2156 wrote to memory of 4300	2156	chrome.exe	106
PID 2156 wrote to memory of 4300	2156	chrome.exe	106
PID 2156 wrote to memory of 1088	2156	chrome.exe	107
PID 2156 wrote to memory of 4720	2156	chrome.exe	110
PID 2156 wrote to memory of 4720	2156	chrome.exe	110
PID 2156 wrote to memory of 1184	2156	chrome.exe	112
PID 2156 wrote to memory of 5060	2156	chrome.exe	113
PID 2156 wrote to memory of 2112	2156	chrome.exe	114

C:\Users\Admin\AppData\Local\Temp\YBClicker.exe
"C:\Users\Admin\AppData\Local\Temp\YBClicker.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf4,0x120,0x7ffe7ca9c728,0x7ffe7ca9c734,0x7ffe7ca9c740
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,7614381977558348245,9336070998746977102,524288 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,7941761135112975431,14060142733347134156,262144 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,7646383732749536907,16266135829490941810,524288 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,214985028403873244,4046586728085265450,2097152 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,14026492102485417329,15741701757876828171,2097152 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,11107703469779972220,4917559725591259470,2097152 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4644 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,7742579126290823490,4607372692368157732,2097152 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4996,i,17366492958447937715,7447345368288504407,2097152 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,3869815427507762263,10879533352969000631,524288 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5780,i,8435588850168630554,8820050907008903097,2097152 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,12083701262676591350,1600308474432137789,524288 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,6052078508599993527,17671427471048557483,524288 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,2466642295002427421,1952874317813057220,524288 --field-trial-handle=2016,i,2208371167873401190,16207921906382890189,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:2112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe7ca9c728,0x7ffe7ca9c734,0x7ffe7ca9c740
  2⤵
  PID:2672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4fd5d530ed140946270170fdf7d661512728c262868b84d775fc44f4fbe643cc
MD5 cb777f6d108ce927a3a5049b67de4c6e
SHA1 2aff4d8db7d4bc8709fcec51e3550b60188bf97c
SHA512 7aaae7f8f5dc4b32e6b04394fea8ca18e72dd428a8ccbc933a49f30aeb0953074a5d78b35cc8ad29d943f02a7c2a9dc8d8fc8bace730a738341be2032bc3c2e2
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c572b6b8870fad38ec29cba70f2cb72cead3372cbf2f4c00b7920ea47de7cf0b
MD5 7cde147024d7daafa404b97376e90603
SHA1 536ef976059ace1954050e9933ebbc778af7119c
SHA512 e05abf663b3766e4c3c4c777bab1a5b8cadd890cd28360a4e0e420da03ce0e4369ceba643a1327584bd3a441aa733d322e878583403ffd8d7e567617d536ee08
TLSH
T10BE02BBAD921ED3B08FD075861510786E740235A2BC0440F3A3EC60D8FB463A068286C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 aca08bdf09ce4970d4249b3742fb96f5be98312bab337ebe5c93d07345b042c9
MD5 346bc4301480ae4e98627eeb8ab67e5d
SHA1 c92704c714c0da1ec99b7caca02d2b7763134700
SHA512 cb3173004376f1388b9fc20e082e31956c804b6b736415369e79e2c8cc31b73bd4c4393db833a9a1386aa4d8bc2351f40df669cb1976f501fe24046dd4ca8dd6
TLSH
T1C111CB0A273BD336EB74663DE4774CBA58B8084D9C65096B24E1C1A842632F120214B1
MD5 SHA1 SHA512 TLSH

Submit Download

0fd2d021-c1ad-4237-af38-60db28582c1a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0fd2d021-c1ad-4237-af38-60db28582c1a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5adbc3364232df73f98f4c1bb4f4fd88b830597e49191631bb33211d556c17b6
MD5 cc1548281ad8b978dbe18754eef8c8cd
SHA1 64c82ba29e3fc9fa66744e8fbf17130b5ac097f4
SHA512 b5a7385271693d90f18de23a1b559bd69b1792591c34e7bb72094da5b1588eea2821d3d8ae89cb6c21a80b8b2977a3465527ed7ddbc9f369f4803280e12f462e
SSDEEP 192:DwN5v2cSjibdaIacQWIjcL7J/ILRYW1IYIRIStHZgjhs:DwN5v2cSjibdaIacQW2cL7J/ILRYW1IH
TLSH
T1C4E1BFF7C3D9C66D895156F4AB156E1ECD2E0A14432C3C27C8D8AF4B57E68B2D21138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 bb1f9e80d3a1749739532b90fdf3d15c230d1130af01ff242fb2027696d73d52
MD5 03cf57787303f3c1a7b48c33841490b5
SHA1 6e203681f9cac326cb67bbdc74989cb96013d6e7
SHA512 6d9a327b87457f675a692c971cfdf0153fd073a4d816f93d48ee88d706ac7a1697d5a0138cb01627e85179826201b0131a95c099a176adc11fef9eb014ce3594
TLSH
T1E3019E97D77A745701BC44A76E04B84564B27831034564F0CEABC0ACE09D8E31F03453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8e5e1a2c483109d2c42027709f9dc0befb45b775993667e2a76a4bb3aa21f0fc
MD5 7b73bffc35e26874266b7e6aeae7a2fc
SHA1 71e83eb9fc1aeff1443e238f2d3ff97444228175
SHA512 f1be62828af3968260d4852986b31ad0afac8132492a23c56b9309d13e3d512705d86fd7bb649a794d48eecc74dac6b32ebc4cb4c28a9cd2bee679b561543654
SSDEEP 192:aRccBzzhYNGXzquv7CMhAPRp2fVt93Hsb+WNnlx+WUz2112X/aiZPseqtVyIsnAq:aRcmzzKNGGKx8XOxw+p272Pa/e
TLSH
T1EF52D61EA920693F9CEBC319F922775BD7F5202165852E84E6FC8A2C05EB5CD221B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 df2d5dd13a5e3dda6e5d4bfae5beb11772d5b4cdfdff93a66963b8ffd77c3077
MD5 7d2702804261cdb0c75866d3c42da121
SHA1 ac762467662b65e1780bd3cd94b8c33033344c5e
SHA512 0814d9fcfce2de025cd78a8df93b6d7b81398959c371f39a5d1ab99861bd049d7b1fefcded0e5111f39508b70cffbb797b6e78317871cfb346e809ce16c0373e
SSDEEP 192:aR2cBzznYNGXzqPv7CMhfPRpXfVt93Hsb+WNnlx+WUz2612X/aiZPseqVPyIsnAq:aR2mzzYNGGHxdXzxw+p222Pa1e
TLSH
T1C452091EA920693F9CEBC329F921B75BD7F5202165D52E84E6FCCA1C09EB5CD211B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a569df5e4c03d1915b2f7ee6683cc2956d697e7f39518f19c4dc03811b2092c9
MD5 0ab194c29b6aaa90bbeb211f0df56d01
SHA1 4dc8d3e95efbde72f33c2ac774b2345a0c859586
SHA512 4d3d458d970fae0f21dd8f66f0c77400c77406dc6efb55df7c8c948ad95a25034d098b340cf6b2ab89f99b4ed5fde96c2ed31d58dac9a160f7dd5283fea661a0
SSDEEP 192:aRccBzzhYNGXzqqv7CMhAPRp2fVt93Hsb+WNnZeBUz2d12X/aiZPseqnVyIsnAU/:aRcmzzKNGGmx8XOxw4G2j2Pat8
TLSH
T14252D71EA924793F9CEBC319F921775BD7F5202165861E84E6FC8A2C09EB5CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 205124c4749711fff1e066ce557602a8567b1db046cc49c1673d970e18066762
MD5 60f2a3e111c93200523162684ef920fb
SHA1 72beba4859d3738c3bac5eba32ca015d8cc59ad7
SHA512 e11b03a434ba9cfd4618125648cb49d635bc140da0c3b9895c198ddbb9f5767abb1b8e7969cae2cb6869bc50cd08f4a2b78fba8380eeca6a9d1b82c3e3af3c31
SSDEEP 192:aRccBzznYNGXzqPv7CMhfPRpXfVt93Hsb+WNnlx+WUz2312X/aiZPseqtVyIsnAq:aRcmzzYNGGHxdXzxw+p2F2Pa/e
TLSH
T1C352F81EA920693F9CEBC329F921B75BD7F5202165D51E84E6FCCA1C09EB5CD221B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 51ef3b9c5e64bfe97ed6a1408fe00a29e1b0b2aeb263c1df7a01d27881805036
MD5 b020c98b1c59d9285815700d70c756c7
SHA1 713ef7dd486d55e40c2252359cb945be869702fb
SHA512 5a1c4fd8fb3245eacdd57371036a5e27cc05dc4979a190691d553d8649b5862728476596e682d44ee7d149c08d1e3c0129e91e13c581c2ead7bb2f1a28132889
TLSH
T1D8B012508002AA42C0C302F81187988833949F219709170193E069B598262A04028150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d46d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d46d.TMP
Size 96B
SHA256 f4afd0cafe7974d5fe06b2fe48bbab411b574156fb9ebe78bf941273f043a60f
MD5 7142fea799f7f7d366c82be2c7305817
SHA1 68cbb85ab2dee62787143bfda7d7b608657a7394
SHA512 7b2586b81867da01281f09762f85014a22846d81d75fa9813512bc9130af75474984df24b2426b56e844e9714f1f3be972ca4f57952787f5c2939df48725c00f
TLSH
T1FAB02200C2032302C00203B028C282E833A2CF20C2030202A2E03E23EC22AB00020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 667866060541f15af5096ad8e96a6ba8be65504e0f24d80ce03d0398cce514f0
MD5 620a91e48552eae5072210ab23b7cf73
SHA1 07b92c0de10dd1c0c06bbccfc5484c56a9bdf356
SHA512 bbdc4754bf01fc3fe35bbe6342bc25a1d713dce08a8765934ab74be3a51265bd6477f20d845181da47e6e3d7a5dc087c53740711e6e7902e37241f9110a83d9f
SSDEEP 6144:CtDaE4zD0mKWd7U4XUrOk0HOGm/SFyEE7:Oj403WurOjuGdF27
TLSH
T1111423A97E3B656B2A7D4383B51D2C0CCC4A5397229B94D8475F73D8D2603863F33962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 312KB
SHA256 50df0b03bce279c2fb26f7d69e063164a333c02350a2e3db03000c5ccf78d808
MD5 82a0f427de1d3dfcca84c4b3043f73b4
SHA1 df138f920ca0621db129fff7b15b31c7e7c61e22
SHA512 4cfacf4d7d290f384d7b7286afa2819e2b67a869c2be9f02b79315a73c51b3f08c32d493ef1716556470e86f980192f4f1b786683a2af57c597acb0076dcce82
SSDEEP 6144:f2WmeRKxiPpVcm1nogOrKDTmH+I0tDaE4zD0mKWd7U4XUrOk0HOGm/SFyEE7:9BKxibcm1nokvRj403WurOjuGdF27
TLSH
T1D46423297F376C970BAD87C6B90A28049D9523C613AF94C85E1973CDD0A2145AE73EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 029d6cf2df295032b4f2791e24625671ae936aeae01de68bb0561b30fbc24325
MD5 d1f90ac15ba75822f289c267c147a231
SHA1 5d5c8c74668cec37f5e7533af021f872e7223125
SHA512 d60b7fca861f9d1368a997d4164a9cd6606468f8482fbb72793a6471df9bab15a004ffd34f41a971f3d9f13a966daab4dda17958bcbd06a67434afed74533a41
SSDEEP 6144:ptDaE4zD0mKWd7U4XUrOk0HOGm/SFyEE7:3j403WurOjuGdF27
TLSH
T1D21423A97E3B656B2A7D4383B51D2C0CCC4A1397229B94D8475F73D8D2603863F33966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 77e2c2b3a63fdb4509f7aeb942aa09e403a3b23b022d9b9ffbe1d29e19640ca0
MD5 b0e3b246b41ccd039b217e50d49a7d08
SHA1 b14b689c11e14e9caec49d65310d11838ea38012
SHA512 03169c72001905ff1f09b7374c9b1635320e0be8327d7515574740261ce34184f8068426bf21799992178217778dc4c8c808a3443abab330dcb03932d7b9c197
SSDEEP 1536:ip/IcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aI3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1809312BA4E2646F7997D4A8176AE7909CE12534D705FA9CC325CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 84ff07ca8a6e9d9855e8f5784b982c12e71cacb619a1f28d79d712394ba76b80
MD5 aea91b569ec3ba9793a494eee626f377
SHA1 7e6cc286f5a86902c4eedee4eb40a09627e47014
SHA512 f950fe27d8a9d1ffeaa73faf5247e62af4be83f91e102a9ed46a94c16b5f4228871b8a31e3b51e6adf17f2f1e28f7406f2cb9941309750308e2c8169d814d83b
SSDEEP 6144:9tDaE4zD0mKWd7U4XUrOk0HOGm/SFyEE7:rj403WurOjuGdF27
TLSH
T1421423A97E3B656B2A7D4383B51D2C0CCC4A1397229B94D8475F73D8D2603863F33966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 135e28b1e2aa58b8ad39ff07580e990ce1a3c753ee55561268de83859dcd6896
MD5 c5bbbf1f5b02a957c8dd8d5c5246fa2b
SHA1 f7876bdbd82deb95c995effc2db3501fb18365c8
SHA512 da3366e4bbbabe73756af6ce5dd207e4cf317e98d4bf7f8c99d51944331ce663f4d9dc14d14be11d70644b00a4c72d199c2917419674f721f8ceaf10106d7ae2
SSDEEP 3:MsEllllkEthXllkl2zE/l1/K/t:/M/xT02zQe
TLSH
T1C244040CFFD01407D54013304055C35433F0DC14073357433C5104375CC57430C00511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download