hxxps://influeencer[.]com/tiktok-email-finder

Analysis

user interaction
yes
max time kernel
156s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://influeencer.com/tiktok-email-finder
Sample260624-a2lsdshw21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5516	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267353672670257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
1836	chrome.exe
1836	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe
Token: SeShutdownPrivilege	6328	chrome.exe
Token: SeCreatePagefilePrivilege	6328	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe
6328	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 6328 wrote to memory of 2396	6328	chrome.exe	90
PID 6328 wrote to memory of 5664	6328	chrome.exe	91
PID 6328 wrote to memory of 5516	6328	chrome.exe	92
PID 6328 wrote to memory of 5664	6328	chrome.exe	91
PID 6328 wrote to memory of 5708	6328	chrome.exe	93
PID 6328 wrote to memory of 5708	6328	chrome.exe	93
PID 6328 wrote to memory of 7100	6328	chrome.exe	95
PID 6328 wrote to memory of 7100	6328	chrome.exe	95
PID 6328 wrote to memory of 5780	6328	chrome.exe	96
PID 6328 wrote to memory of 5780	6328	chrome.exe	96
PID 6328 wrote to memory of 6008	6328	chrome.exe	97
PID 6328 wrote to memory of 2268	6328	chrome.exe	99
PID 6328 wrote to memory of 2268	6328	chrome.exe	99
PID 6328 wrote to memory of 6384	6328	chrome.exe	100
PID 6328 wrote to memory of 6384	6328	chrome.exe	100
PID 6328 wrote to memory of 1848	6328	chrome.exe	101
PID 6328 wrote to memory of 1848	6328	chrome.exe	101
PID 6328 wrote to memory of 1052	6328	chrome.exe	102
PID 6328 wrote to memory of 1052	6328	chrome.exe	102
PID 6328 wrote to memory of 4448	6328	chrome.exe	104
PID 6328 wrote to memory of 4448	6328	chrome.exe	104
PID 6328 wrote to memory of 6612	6328	chrome.exe	106
PID 6328 wrote to memory of 6612	6328	chrome.exe	106
PID 6328 wrote to memory of 2836	6328	chrome.exe	107
PID 6328 wrote to memory of 2836	6328	chrome.exe	107
PID 6328 wrote to memory of 2220	6328	chrome.exe	108
PID 6328 wrote to memory of 2220	6328	chrome.exe	108
PID 6328 wrote to memory of 252	6328	chrome.exe	110
PID 6328 wrote to memory of 256	6328	chrome.exe	111
PID 6328 wrote to memory of 2756	6328	chrome.exe	112
PID 6328 wrote to memory of 1836	6328	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://influeencer.com/tiktok-email-finder
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdbdc4c728,0x7ffdbdc4c734,0x7ffdbdc4c740
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,442745548384121113,18320657259558811723,262144 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,13793601651005212066,14023431907174317775,524288 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,17965554925819192774,1344454041514454746,524288 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,8949344523333192336,11114305128805898627,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:7100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,17346290850818120719,15948634811329800194,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,10724080515164967800,4052569026937291613,524288 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5248,i,5279757439133881065,18188700818007405458,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,2851451368659009001,15683295556419914354,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:6384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5436,i,13938228642803929697,3414520536627716103,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5284,i,8036529935924394028,16848300741340078399,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5920,i,6491649238544736108,8116985825846327804,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5896,i,10906514161763059110,12599461233171508166,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5284,i,7239638909469850697,17165413344426458907,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6408,i,6039401566202196317,10549722806354684946,2097152 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,16562165157929759292,13814929484067240785,524288 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,14821490589970384862,7328532635223080452,524288 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,17392579293868649848,7551358274333446006,524288 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1128,i,8419025569560265343,1467347499435497163,262144 --field-trial-handle=1912,i,12534471652767793846,11466267600582530411,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2fcf61db-ff50-456b-b958-c969791d05a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2fcf61db-ff50-456b-b958-c969791d05a3.tmp
Size 11KB
SHA256 d1e277aae102aa5d0c705693418ccaf096bbf71954fd55e413952b96a9345eb6
MD5 79d97801c2572187d66d6d77e240cd54
SHA1 98d5329de32efdd32c33b9f0edf35f4478abe26f
SHA512 51fc33ba522952a32719772b310a61068c7ad9a346213b5cf7ae6ebf6439c1201fe27ef76612debbb1e7a11883766720a0dce5a67b4095f23198e569996cf369
SSDEEP 192:eov4K6CE7KxkXqK4I40pUZNCgVLHrKHfFKslHgWXzKD/Vs+ErUkKNwMWLp/B4ZM:Jvj9E7KxkXqKf/pUZNCgVLH2HfgslAWZ
TLSH
T1AB32D927988D9D7F4FDCD50DDC166F8B6CF5029372680D2492FB9D0803E978A524A2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2033b141f1285e17d0e3caf60085a4eee82a5d3651da36786132b052043d3725
MD5 0c666ec1c5cf43ea4be9a61b341e8fb6
SHA1 934355bbf5247d1600ab633c03fefc7c957083a1
SHA512 a29c93b23d87c9875bb07f1f6814ea0387d1c51a1283597ec1f343ecb26116d4fde0e02416534f548bb4a93ffc9262f862575c19391e413b31f372ae271e767d
TLSH
T151B011202A8000AAEBC02333BAC2880033308C088A222BC2C3E8008088003E22003AA8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 13206d9d67bf5ede2e27fa8226b1e9b814f04f40c33d24eea1c4b1a611a93805
MD5 8292592a9da19d0e97baf865674496a9
SHA1 67f16983d4e21981cba58f505d105a60e546dfcd
SHA512 40f5b9899693f262047f234e987847355e1cd5838cae333ed82e7a49dca1bc06dcedea00f329f856c2882f806c5f2dc661b9454a4a51178e17bcc9436a1e806a
TLSH
T1F3516CF7C3E8866D891192F4AB156F1FCE690A18532C3C66C9D4AF0F53E6872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 836ff672ae71d4cf2bde0c38730daa9097060ed54ff23a2e40404cc0e118e555
MD5 944758b6952de8cdf23f51313c4f7c99
SHA1 e2c0c5efc9022539083893d234df51b60f4c9c29
SHA512 da786ddda321b56e8693baa64b3d695a2152dc6861bf0298bc62eca06f45d02bb734002428402e9c50b02ec27ab703180480eae451f923072177ba4de46e4bb0
TLSH
T10E517CF7C3E8866D891192F4AB156F1FCE690A18432C3C66C9D4AF0F53E6872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2b996022c94551890d2682ee11668f343322e4dbe08052d9131171079eeb6156
MD5 67f270d043f915d25ba2cc3cd6bbbd21
SHA1 b55e178195ffd8e3811356a7dc7cbe7746bc6f11
SHA512 7249618b4c2b5638d94c48934513abdc335c26a80565b7c277d84a8aa55595f8e60d32d7332e37b2e1fef28edfab3401c8a8bbe73c1531511943668712401106
SSDEEP 192:sRD/+VBov76JhvAPRp2tz9AHsb+WNnJ9DPf82WbehQQVyIsnAUge:sRD/+H0Q6Xi2wrA2wUe
TLSH
T18032A32AAD24693B9CCBD229FD65B757E6F5143271D42E80EAFC8B2C10D79CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9bd2333891d47a36f858f88fc747e1080ff9cbd0d8353e89aec3d4a56283524d
MD5 a05b064b70da74dfd5d6c85173197f20
SHA1 58a9b2b30d9b21978fd7de612e0961c0651efd90
SHA512 7ee3cb331772512427a8c243f8e747953e3431491fa0d66f38ba2e3f7ce5437dc09af4fb19fb37d2cb6496b696304988a92d61ae0709e8e572ef2a409135367b
SSDEEP 192:sRD/+VBgv76Jhv4PRp2tz9AHsb+WNnJ9DbrcpIbehcQ8yIsnAUgE:sRD/+H8QiXi2wrLcpSDE
TLSH
T1B542A41AA914693B9CCBD26DFD65BB57E6F5103272D02E84E6FC8B2C11E79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 05c8ffa0bef7e7d0d1551a921ffdde480611ccaa50b09a9c37fb15fbf993a17f
MD5 904354b9b0d2a7b25da45522cd84c8be
SHA1 10ce765e29508a20d767ad26e19b8552ede17751
SHA512 a54bf8c381e916bfdf1df0c288cf23b10aed4a4a72ea79707431bbed750b55851aa1372d7f72be84f30e23502a085137d09d166dd2eaee4fd928e4fe2d42a85a
SSDEEP 192:sRD/+VBgv76JhvAPRp2tz9AHsb+WNnJ9D6xYjbehQQ8yIsnAUge:sRD/+H8Q6Xi2wrEY7De
TLSH
T12F32A42AAD24693B9CCBD229FD65B757E6F5103271D42E84EAFC8B2C11D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f0f252388cc58d92da99308d424fc6d40b61727b7a7bbdafaf3bacde8f209d21
MD5 8fa225161e2a5b8f14f9f052ea9def53
SHA1 d6d5468f87dfc68e997063a10c2515534b5fb09b
SHA512 744e03f400317645778dd1262095309cfa53edf9482e8e1f6ef08758809b8a67c027899a847a242249dd8500602dd6bdcae4f535ce5015b04a3e5bd4edbf7c6c
SSDEEP 96:UMbJ6bod+klsgvZRFKs+X71f/QjlXSl8h4otop5tpHDJB66GyvE1BLcV3HRiC5su:htbfls4fFKs6lQ3iU2njPOtBLcVhiC5j
TLSH
T181C13AB1787C5CB259FAD859B4033E03CDB0A1ABA691AE64DBE94F0C01DB5ED2342127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 46KB
SHA256 b526bedbc2ccd94826709ac7cdf20e1bf3d1b5380470be0b310a96e52a98542f
MD5 5b65bae71c79193230cc6a87c45ff521
SHA1 7676d7bac8bfab685cc5d10ede49a94cc5c411e1
SHA512 bc5af3b16026ffd8b4bc44689f9e3e6f073b24b3cfedc53653e04ac62aa514ccff74308c06de3e22a65d96b27895f59bbecbb9c89817f3cd37c1f1980b250c69
SSDEEP 768:3bl8NXNeaxhHETWZhkGyv0vSM5IZVN1kZyO7g4RdlCDuXXW8+n8ZAWg4KT4HjiFV:rqNsaTHQWyMKM5IZVN1YRvCKXg8Ng4od
TLSH
T13923F1D5386CC852FBB4C05CB1133542CC5D262BD814AFD89BDD524A216E8AF5A1E27B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 61989ed353ea8fd82e2161860866d002721dca0d7a8235303bba7da311c37e83
MD5 2cb04ac43a2b026cbdbb9bf1b97b27b0
SHA1 dc4b39202c91de744151afe3652e8b81d1b1bf29
SHA512 faf1a3022db9114e1b0ba50e5bdb70c53cb6a2ae1a2da20e8605ee94a7117bf9b49b2e93635c316ca4ee0f09f49f835caf907f9e637fc90588971a90b8ae96e4
SSDEEP 96:UuC6bod+klsgvZRFKs+X71f/3Rl1RDotok5tpqDJB6eGyvE1BL+z5sdbEs3v4a:BCbfls4fFKs6l3DDUDnMP6tBL+z5AbF
TLSH
T102A11A7274784D7389BAD989B4927E03CEB86157B5916FC0D9ED1F0C00A74DC1301137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download