4ffe7efe050719355d0e46757212c1b7bdb2a97f4d2d66636ed0207594956081

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bin/Loader.exe
Size 270KB
Sample260620-stem8afx4l
SHA256 4ffe7efe050719355d0e46757212c1b7bdb2a97f4d2d66636ed0207594956081
MD5 b3392558c7af82e1ffab11cfa98e3647
SHA1 f4681d108b7c8f517790469fd6d6aff2e7729e82
SHA512 c297e2d34ddede1383f3d740b24eab445a9af29b54eb0ab12c4db127faa4b1d954e3cd63e409297aee3e0c349a5cc20ac131e3ec95234fe1a2bf9b3a7a8f358d
SSDEEP 3072:zZ7cu4U2PJYwikSy5Yx1Y968z8e1KYwU5+:17x43PJ3ikSy5a109o0
TLSH
T1DC44C011EC1BE6A7D31F0C74D8130916FD72DCC6CBE9A652A7445EFA0868B54BB1EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264427293763636"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 672	2396	chrome.exe	84
PID 3140 wrote to memory of 3748	3140	chrome.exe	86
PID 2396 wrote to memory of 3452	2396	chrome.exe	87
PID 2396 wrote to memory of 3452	2396	chrome.exe	87
PID 2396 wrote to memory of 4988	2396	chrome.exe	88
PID 2396 wrote to memory of 2372	2396	chrome.exe	90
PID 2396 wrote to memory of 2372	2396	chrome.exe	90
PID 2396 wrote to memory of 2952	2396	chrome.exe	91
PID 2396 wrote to memory of 1716	2396	chrome.exe	92
PID 2396 wrote to memory of 2952	2396	chrome.exe	91
PID 2396 wrote to memory of 1716	2396	chrome.exe	92
PID 2396 wrote to memory of 2336	2396	chrome.exe	94
PID 2396 wrote to memory of 2336	2396	chrome.exe	94
PID 2396 wrote to memory of 2608	2396	chrome.exe	95
PID 2396 wrote to memory of 2608	2396	chrome.exe	95
PID 2396 wrote to memory of 784	2396	chrome.exe	96
PID 2396 wrote to memory of 784	2396	chrome.exe	96
PID 2396 wrote to memory of 2296	2396	chrome.exe	97
PID 2396 wrote to memory of 2296	2396	chrome.exe	97
PID 2396 wrote to memory of 2188	2396	chrome.exe	98
PID 2396 wrote to memory of 3928	2396	chrome.exe	100
PID 2396 wrote to memory of 3160	2396	chrome.exe	101
PID 2396 wrote to memory of 3312	2396	chrome.exe	102
PID 2396 wrote to memory of 2224	2396	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\Bin\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Bin\Loader.exe"
1⤵
PID:1584

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b4f7c728,0x7ff9b4f7c734,0x7ff9b4f7c740
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,12295100669797661101,2201216637881184928,262144 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,15049922570728287456,4912410009643493908,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11182127252312671624,9585804683562154243,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,9341750117039862535,5670594443125729200,2097152 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,14267092299101744203,4720450937322074468,2097152 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,10662161112834706370,17794142698756054971,2097152 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:9
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4308,i,15898389350329479571,13235887250522887300,2097152 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,13603523110668570946,13137382299075728290,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,1852102299514134162,14175611572650041630,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,9614965028423725926,2669217749550845420,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,16716173828641112115,17186970084399139525,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,13533652609170954571,17636649921783126763,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,9307813427256711234,9556117174563343662,524288 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6120,i,3275031113235213386,15202219663125496375,262144 --field-trial-handle=1976,i,12552268599650523329,962062306909954684,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1292 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b4f7c728,0x7ff9b4f7c734,0x7ff9b4f7c740
  2⤵
  PID:3748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b25f96dc248a84f0d8d356e5d9bfceb424b9e9941087dd77b72f2fe669db9e69
MD5 0de2bb276efed479875804ec015e3c6d
SHA1 a7db48e79cd4d4a7131a005c637a4863f57c92e9
SHA512 e6e6df3e6cecfc9ebae0a32fc319002594b8277cd873abd86e83aef75878461bc646b360e9bd51925b91da034847ee25b62a20b486a000188653ffac0b93805d
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 25cdeac8d04d53a0632d8f12337f9a5e56c1e1f751dc1189aaf289fa1d306a8b
MD5 01defd7040457693fe481a4f1272b477
SHA1 ce612b2da26c7b437170f0b460cdcaab123273f2
SHA512 721b4b3ea8bbf2812fa9044006e5b5a63fcb12993f37bccedb673f3674e2862075d18b39cab040ebe4a46de02cd5ff785af636684884ae1b1ae2c048743fb3a6
TLSH
T1EBE02BAADD22EC3B0AFD27197051574BE750131B2750494F3A3C920D8FB263B45C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 78750f1a8e4d6ae338d65f8e6c7a272bb44acc9f0f152fb3df105780f92fb926
MD5 591be3a8e4103dfd604ecedadce1b2d3
SHA1 4c7757affd790a4cd971064d52ff0a08bc9ae8ae
SHA512 9c3f9d68fec3212b5c9e63bb6db2eb4efc68edff922baaaad0b9a71c492c050ce8e551880c48a541d37bcd0a8256543357765d8550140b2cdf5bb40195543930
TLSH
T1B3516BF7D3E48A6D851152F4AA216E1FDD3D1A18432C3C66C8D4EF4B53E2872D21139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a0733cb321103adffae3a3d5984797bebb32bb0f0d16d4bdfef3f9356c44b377
MD5 b8ab1e76e332b40f8f919afedf114a3a
SHA1 f67ec1797d664b5913ffcb63b06ce16d7588a18b
SHA512 a82028aec5871cc2a1a6a0a58304449c1ea26b71012a74453f4534b791b62c9a9185e354f3d421b108bf977bc7b2c0c5970fc718a0c9b6cb0646a57fec6b337a
SSDEEP 192:hRDdFqP5VUDoQJv75pAPRp2A98Hsb+WNnoHn3OgkwwalFVyIsnAUgraJ:hRDdFYVURJVUXLuwsnHQaNe
TLSH
T11742D62EFD10697B9CCAD219F9627767D3F5102175942E84EAFCCA2C18E79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3310eb2d60ffb99f0be75a96b6857ffa40c39d4ab501a1e4534493d0b22cbb72
MD5 3af0b67e523a6de70366fe1a32d4c741
SHA1 3c6adf76fe8f8bc040e57987e467183fdf8f0571
SHA512 c7ea020f9412c2c12aca270d9159c4bf821c345f68e690f14a0b13492769154a72e67e0d71ad0bbf0b91603bf03e5b49361462f393849a16353967c29e28d8d5
SSDEEP 192:hRDdFqP5VUDoQ+v75pAPRp2A98Hsb+WNnoHnvOgkwwalWVyIsnAUgtaJ:hRDdFYVUR6VUXLuwsn/QaQ8
TLSH
T1C942D62EFD10697B9CCAD219FD667767D3F5102175942E84EAFC8A2C18E79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 48078fa9d98f8120093e4865413f8fd3324ac166d50c9354fbb406e5a6a421df
MD5 51c263d9251b538b72a2198931f1a929
SHA1 08ce7fa0e765c8bc2444d9350277b76251274545
SHA512 fbfeeef49fe982e13be271dad8f67552845d730e8ff8f6ab15dc3d1dc110a134d0a07024795513e11d46e1cc3843fa0b35df074dd8cd730305524ae2e0d2b35d
TLSH
T1E5B0120080029A42C44202B41143148871245F10D60E170A83F469E6DC35172C014060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c07c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c07c.TMP
Size 96B
SHA256 b80442344a04cd1c236d9a07a9646598e0ae4b59845d7544adad763f9c32ba3e
MD5 56e6eaca91718844802e6376689a8df3
SHA1 f1965a9d26cccbfa8d1becc61f2039942af01cb8
SHA512 57504852897dc45504da6c5a170eec34bbf6f696103ced6e56115c0f29fb4aed5760789aebc375c63f03d6fb4f43c8a6ef05311d2fe02ae44fd558efa4cbc5f7
TLSH
T122B022A2C203A2A2C02203F028A08BC83020CF20CA0B0203CAE00AE3CC2023000200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 6357ae0e8386f7ff9b6cc5c925eb1c4ce0e1884236fca5f483b5211fd0f654e7
MD5 92a930838cd3d9ef34c9ae5feed622d0
SHA1 cbc5a8b97ca76430f854c8e24390fb78cf4bac1d
SHA512 713d75e4767e81a868bc9966c2730c486c6cbcdae281c2f2984897f70480cc581656d6ed35eab17e355365b13c51162dc845c758981a66458ab7ef9029cbc23a
SSDEEP 3072:qptoSKa6qMwgCh3hodf8U8+RhpNnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM9:qp2wgARsUiREm7Rkm1tYpBeh2BAo9
TLSH
T10534223E1D91AC7B4DF6B709708F5BAE1E75CDA2D818C95180EC6E0872E5AC94543E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 351ab827aeee7175429b982e6efb7774debe879b3039d44cc7f387ec2b6c59cd
MD5 379e18d823e6eeeb85e862fd05449469
SHA1 d9fe8b562e968989b9511da0e7c5b06ee8d951b9
SHA512 162cece5e3978af860c73b6d584edcc55878e7acf15ab233340b12d15fa5e493d313d9ba123b1a291c2631f76c54502d31ee0d66ae7cb8a757eae3117fb7ba09
SSDEEP 3072:/xtoSKa6qMwgCh3hodf8U8+RhpNnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM9:/x2wgARsUiREm7Rkm1tYpBeh2BAo9
TLSH
T18F34233E1C91AC7B0DF6B644708FABAA1DB5CDA3D818D95584E83F087294ADD4443E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 9ae758984ae52a3bcb96679e981fbceca09cf7a5c2dbd8195dd1e9ae796e8a13
MD5 d29e1839032d94da677016797426416a
SHA1 18e14e80b208fdc8c5db71a1fa8ce26e21f6298c
SHA512 0e5f83bbcd1d0997a619dda1fd1af0246ad480c8ecb3e57b967b41cc17c10ef17c5a8022a8749fa6cb211ec7c6b498ec0f87138e1c4c96aeaea2b4f144de5860
SSDEEP 3072:RptoSKa6qMwgCh3hodf8U8+RhpNnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM9:Rp2wgARsUiREm7Rkm1tYpBeh2BAo9
TLSH
T1CA34223E1D91AC7B4DF6B709B08F5BAE1E75CDA2D818C95180EC6E0872E5EC94543E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0b6155fe77d63ea559df58a0928e66bbfb2ac1c828377c5bcbc578f88e6f766e
MD5 222b432c622a27f36540d5d154983b65
SHA1 bf3926359452e0adc743a3eb7f16adfd4584d978
SHA512 bbe22f5e1afad4f668b5cff1ed9797d2b931f6a0805543eed2cf32bce7b14744c34ce226a23595101291021a0b167aa46fa626a8b653c9e376de65d1daacdbb9
SSDEEP 3072:UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Xm7Rkm1tYpBeh2BAoF
TLSH
T11AC3122B5D70A97759B8BB5EB08E0B1E1EF149A6CD30DE92C8D85A0477F97CC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 8aa20b4b85352dac91eb6e840dca70a9e1f4032967da8cbde10a37442e3253a4
MD5 e4e2d7538ac9818b02eea34b7c4e9a87
SHA1 a9916aaea7022b92dff77b95e9d119a310895248
SHA512 c80a870dc864b0bc40ab17a3f5cda576b96fa77c8ead4b9c2a228a85d09a4bde5fc5c9d377825aeeff942f82013d6719a7c39b57640b7e4ea7e300ee7d2f5b32
SSDEEP 384:oJWJGVca12krtuVm+gglBOVjeQ8RJoP5ghvjUkBWa5PGm5x+GDa50XYScm3iYXEr:k+GVcWrpl8RJI5gZjUkBvPx+GDa50XYL
TLSH
T19AA23B743AF51315F3F29F759AF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-0-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/1584-1-0x0000000140000000-0x0000000140048000-memory.dmp

Download