hxxps://miraculous[.]to/ar/episodes

Analysis

user interaction
yes
max time kernel
48s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://miraculous.to/ar/episodes
Sample260626-dljvmsgx3x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1308	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269167654143271"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4900	LogonUI.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3172	2308	chrome.exe	88
PID 2308 wrote to memory of 1308	2308	chrome.exe	89
PID 2308 wrote to memory of 1264	2308	chrome.exe	90
PID 2308 wrote to memory of 1264	2308	chrome.exe	90
PID 2308 wrote to memory of 940	2308	chrome.exe	91
PID 2308 wrote to memory of 940	2308	chrome.exe	91
PID 2308 wrote to memory of 456	2308	chrome.exe	92
PID 2308 wrote to memory of 456	2308	chrome.exe	92
PID 2308 wrote to memory of 4112	2308	chrome.exe	93
PID 2308 wrote to memory of 4112	2308	chrome.exe	93
PID 2308 wrote to memory of 1832	2308	chrome.exe	99
PID 2308 wrote to memory of 2804	2308	chrome.exe	106
PID 2308 wrote to memory of 2804	2308	chrome.exe	106
PID 2308 wrote to memory of 548	2308	chrome.exe	107
PID 2308 wrote to memory of 548	2308	chrome.exe	107
PID 2308 wrote to memory of 4144	2308	chrome.exe	108
PID 2308 wrote to memory of 4144	2308	chrome.exe	108
PID 2308 wrote to memory of 3464	2308	chrome.exe	109
PID 2308 wrote to memory of 3464	2308	chrome.exe	109
PID 2308 wrote to memory of 4404	2308	chrome.exe	112
PID 2308 wrote to memory of 2112	2308	chrome.exe	113
PID 2308 wrote to memory of 2816	2308	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://miraculous.to/ar/episodes
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9bc81c728,0x7ff9bc81c734,0x7ff9bc81c740
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,4687387535634501869,9518635640473474715,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,1274954433273451351,9979017352141432480,262144 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,6639306899162626687,14028786777699616338,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,13935520948836743829,6319140014232323018,2097152 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,15648937706395576226,11066275295196391285,2097152 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,7043829064760280029,6491071223784965155,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5384,i,1958791007020652636,9354750728878426963,2097152 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5852,i,13302289087951892272,14765465726251857121,2097152 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5928,i,18109075461430217362,13263311526036338034,2097152 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,8279384675215573448,14321438277775412186,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,17813069982519081001,404200048833692717,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,9680726140056821469,7909615220660180333,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,15148951610496613365,16813867415331198917,524288 --field-trial-handle=2004,i,15810847695168069042,14807609601712734896,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4748

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3975055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89e3720e-b447-4e38-85be-83041e653ce1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\89e3720e-b447-4e38-85be-83041e653ce1.tmp
Size 116KB
SHA256 babca325710e30e573357e913bbfc3d3da65490d09798adc3a4e999723f1f852
MD5 77499f0614963aabd5dd4dc225ff89d9
SHA1 77c4a95173341be41a39663e91741c97cd3e8b49
SHA512 26f73f67d2736c5fcaeac80c9a29497ecc4192d5d861eb56dafad19f5165a61c9cfaad81047da0f32433bf5620607e68d894e48557c6978cc676e8ec2dfc5e56
SSDEEP 3072:9LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:9Sm7Rkm1tYpBeh2BAoO
TLSH
T175C3123BAD65E9375DB9B71AB04E0A1F1EF14DA7C920DE52C8D85B0433E97CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48a3e5c06039db2f0153f47886cea6da610741be7668059e5b7d31edf65e0dc0
MD5 5483684ab4ddb4eb2e1469608f6abb8a
SHA1 1e2245609a36db2bce32eccc27e58404153ab550
SHA512 8f3e877f2295f387fb3930aa5713a3dd84e263842472ba0d1052a1bc42d4b2afe234110be5fe7dbe555d43a738ec163c263ada636dcc9b604a6af3d0c8fd5a79
TLSH
T1D1E02BBADF79AC2B68F9472C6154074AE64013573B80894F363C8109CFB9B3A4596C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 57d36ae4f31289f9e309e95dabc7750cfce0a1000ed3caff3a50e06c6bb29983
MD5 9b0c092e1fd57176c3e6971b442c594b
SHA1 abd68136b2267ea42ed25955e6d6f24e5557e754
SHA512 1e9d6727ac63d497dcc6bd147bd9108f576971038f710fd633037c196e604892cc943e9fe910a720efb4da6b7c9119f9cf8b5e23955e4c365953b0fa08e01be3
TLSH
T13A01441072A3DABDDBC80AF4C6A58C4477FE186805EA2A0E8024F3F449063EFAB4045C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a050c7a1b935a49716fa15b968130184167c9af6fb92e6d95351495a6b188c68
MD5 9963cd6110833b47cf3121495736cd11
SHA1 16e96603cb71e19db17d3fa11442533dcbcf41cf
SHA512 252069de502fbfa40a7f9321aeec11f74c67be1270957fcbee8f36a4ee17deaff4f832bdc498ca8c0452835e62c37d2b074b79efd1d89f3b65b95be8de9d5e3e
SSDEEP 192:D4V4C4P4K4B4R4V4/4S4u4H6aIaEd+J4f404R4F434U4304C4T474C4j4yb4ye4j:D4V4C4P4K4B4R4V4/4S4u4H6aIaEd+JY
TLSH
T193127CB7C7F8866DC80156F46724AE1FDE1D0969432C3C26C9D59F9BA3D2472E203A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c26d451d92394c26276028d176ccd959ac6f09e96f8f46031a1f97297aa81243
MD5 fc9023f6f7876a12a7d02249d39a349b
SHA1 5f84edb9db2204f0092cad29b0a84fa2899e569f
SHA512 7606a8082060ef715d284dbc98389679f510528c2fe850dde36590b1c69565f46383c281fbd28198d7b296d9d0efd6a9b6f7f0efc9f5bcb7fd30b319f41ecfec
TLSH
T1BE31C2ABD5BFB42B102E88AF0D407C0A56F9A435125268F4CE77C15DF0C94F79B264A7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4ce5fca8a07637f0154e8d0a048e8715612771579de0ac67b9b5877f7b9959ca
MD5 d3d703a13fe7a08b8b8d3913d187fc53
SHA1 964d92f933de600145deab73840c33e4cbf28e7f
SHA512 4d99626dfce3a5de2ed5df859a1d618ab6b4ccf7e51dd15998b907aeba611729fe074f6995b3ac1e6f9f027897f8132d8d42086f09c222949b3eb31eca7f04d5
SSDEEP 192:/RnCxoXv78pAPRp2Xll29DHsb+WNnYRXlHpe12TMP2739aY1OVyIsnAUge:/RnC2/4UXx5wuE262xaFe
TLSH
T1B242C82EA910693BACD7D31AFD257713D3F5102261D52E94EAFC8A2C14DB9CC312751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d08569562aa73bd6817dd4a6a7455512d6cad063cee5cb1ce4a4ee9fbd6f162c
MD5 8754d1bd660916a4f1c93445e114a864
SHA1 184140e715f823ee708bf5cb972c50f4cc92a46a
SHA512 824d2ef405d60a88f8b4f357668baaecd2621c2464234665bc02caaa6fa52f445582da35de0449554f1a80d07dd5c6c5e35ee1931435070c20c6714fb1614028
SSDEEP 192:/RnCxomv78pAPRp2Xlp9DHsb+WNnYRX6JedP2739aY1OVyIsnAUg57Q:/RnC2S4UXw5wuweF2xaF5E
TLSH
T1DF42D82EA910293BACD7C31AFE257757D7F5102271952E88EAFC8A2C14EB5CC312751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 021e681fe3d40da207345329083cb61f727eb06b667093f742e776082aa43e96
MD5 7bc10bb8eefaee2d2a5093774cc07992
SHA1 b25e5f92fc0ec0d1399d10f5ed28ea42fa93dc7a
SHA512 b8ff8be10f2f58dc145259de90586864255d35cd7b63ad21e4d45ffd3e9abb798b9d8a23dae7d905e4872c16aa73b28acd2a78251a20dba3e5529fa7365ef0ae
SSDEEP 192:/RnCxoyv78pAPRp2Xlp9DHsb+WNnYRXv0VaLP2739aY1MVyIsnAUgv7Q:/RnC2e4UXw5wu8VaD2xabvE
TLSH
T16C42D72EA910293BACDBD31AFE267713D7F5102261D52E94EAFC8A2C14EB5CC311751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 61b8adf03558246eda5c19fd2acf944bad9e0c79e386c5cbe8caed2751c570d3
MD5 07491f327470619490b23b3ea2ef7b29
SHA1 53c59fe4ac2e9c8cd6ef8a624ce452be8c72d6e8
SHA512 29dad3e751a4cf7d6e197c2dafe7105e533d5f440888bf37d5788a28855837a989ce2f7d258eaa206eea47ad338c8f93174613d40d000bc551fe00763e2e3ac1
SSDEEP 3:MsEllllkEthXllkl2zEklC:/M/xT02zn
TLSH
T16C4404047FD40405DD0010304011C35003F0D7F4457377C33C5105D35CC55405C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9f06e413d9241e19e6ff697e842394a6e092d752d18439f820d6121c5fa71699
MD5 919a1b9832e23c809e7820ccd09153b5
SHA1 915dce498642bd2c80510f06969401b268989766
SHA512 f98b53993eca810f6fc1e8dc1ad6f3d49e419514d1ad6d5ba4979f9dd19f3290c00504dd6d2020dab176a29adc11c16cd6ce5c5dbb452aae5b464c9777a04a17
SSDEEP 3072:8Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Pm7Rkm1tYpBeh2BAoO
TLSH
T134C3123B5D65E9375D79A71EB48E0B1E1EF249A6C930DE42C8D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fa8f82a9e7344bf14a3f0ad0acd761df3e239d933de67f9d951bb2c95925a05a
MD5 e3a1839c23d4eef779a363891cecffb5
SHA1 fcdfc220efa0a472f1a31511a3dd4af8b4db5b49
SHA512 ad8d3e7d1753b96987e3e09668680c904c149ec0f830e411417798cc0849f975cbfa89f6875c3e3ecb45e3e08da6a8c5a7205533b339fee5a6b0f4d26e3d5658
SSDEEP 3072:ILGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:ISm7Rkm1tYpBeh2BAoO
TLSH
T124C3123BAD65E9375CB9B71AB04E0A1F1EF14DA7C920DE52C8D85B0433E97CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads