7fcdd816609a3a5ab122b5b8b5442eed455e947533149a9393d09f0cb466be94

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
devilengine-x86_64-SSE4-AVX2.exe
Size 16.4MB
Sample260711-e68j6sbx2m
SHA256 7fcdd816609a3a5ab122b5b8b5442eed455e947533149a9393d09f0cb466be94
MD5 ec8e36864eb9a98fb54ab0a2d345f853
SHA1 b2f876a83fa4bfe92fe56251f4da541447b9e309
SHA512 dd233d2734d379210037705bf4110688c23063915acc08268504ed0ed3e7082982ecdb61c1212ab7a0d3852293d0a2f1b9adedec2fba30f43e81e45f9d8548ff
SSDEEP 393216:hu1NJf/dhzMYmcDbqCwxtRPQaDLjcJw8r:hyhbq1LIwe
TLSH
T176075CBB76619A98C0CAC1B15597CBE22F31BD2408B5134723D9331E9FF68805E5AD8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
135	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1064	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282181406487364"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2664	3992	chrome.exe	102
PID 3992 wrote to memory of 1064	3992	chrome.exe	104
PID 3992 wrote to memory of 3932	3992	chrome.exe	105
PID 3992 wrote to memory of 3932	3992	chrome.exe	105
PID 3992 wrote to memory of 3640	3992	chrome.exe	106
PID 3992 wrote to memory of 3640	3992	chrome.exe	106
PID 3992 wrote to memory of 4868	3992	chrome.exe	107
PID 3992 wrote to memory of 4448	3992	chrome.exe	108
PID 3992 wrote to memory of 4868	3992	chrome.exe	107
PID 3992 wrote to memory of 4448	3992	chrome.exe	108
PID 3992 wrote to memory of 2804	3992	chrome.exe	109
PID 3992 wrote to memory of 2804	3992	chrome.exe	109
PID 3992 wrote to memory of 1704	3992	chrome.exe	110
PID 3992 wrote to memory of 1704	3992	chrome.exe	110
PID 3992 wrote to memory of 1852	3992	chrome.exe	111
PID 3992 wrote to memory of 1852	3992	chrome.exe	111
PID 3992 wrote to memory of 4532	3992	chrome.exe	112
PID 3992 wrote to memory of 4532	3992	chrome.exe	112
PID 3992 wrote to memory of 1520	3992	chrome.exe	113
PID 3992 wrote to memory of 2184	3992	chrome.exe	115
PID 3992 wrote to memory of 2184	3992	chrome.exe	115
PID 3992 wrote to memory of 4200	3992	chrome.exe	116
PID 3992 wrote to memory of 4200	3992	chrome.exe	116
PID 3992 wrote to memory of 1164	3992	chrome.exe	117
PID 3992 wrote to memory of 1164	3992	chrome.exe	117
PID 3992 wrote to memory of 4520	3992	chrome.exe	118
PID 3992 wrote to memory of 2104	3992	chrome.exe	119
PID 3992 wrote to memory of 644	3992	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\devilengine-x86_64-SSE4-AVX2.exe
"C:\Users\Admin\AppData\Local\Temp\devilengine-x86_64-SSE4-AVX2.exe"
1⤵
PID:5100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffecb83c728,0x7ffecb83c734,0x7ffecb83c740
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,1467197916140084196,17488752499779170193,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,15551010030843039761,6762629568385689190,262144 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1508 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,11321787962135361614,17737569570725879837,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,13327855235899081734,16135838528455704722,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15420773353889846027,1977062517969131209,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,11919291790081695846,5056911992814455826,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,4293167713856592247,10149634037927185638,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,13993239594319349800,13723952680030818053,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,3955246423203783281,18113938364487461149,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,18058548426751776525,1449051865091657982,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5904,i,15586222306598149627,11263389238622564724,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3244,i,14045563093418422798,10801421982761767846,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3044,i,10745533957663837114,10743465271646795180,2097152 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,5880274290366526249,6668921450832372574,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,15857344884680921206,3916762680260901284,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,6907655406433793676,3950879114929603038,524288 --field-trial-handle=2052,i,1276678021840591624,6045494486461868068,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2dd62ebd031bd72afb13187d2d7733b626221ff3eb2ab1890a6b9e3d0faa8e47
MD5 3f4e5ac583e34a5305a13d54dab052d2
SHA1 e3cb38ccdb2c924e94ea07deffda072faaf2b138
SHA512 a107f612c80b0d4b5e825b80535425dc5763a933c1ffd39bd009f6fe04edf1729b69fcb7178fce7cb9baee28eac7e5cf082ae32c240751ebfbe009f1faf919bf
TLSH
T102E02BAAC9219C2B18FD5B2960504786E74113163F90C81F3B3DC2098FB5A3A856692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e30638ae796a02846d1f173df328d9893e93fb11628c1193bd973fe58998d73a
MD5 1d0789dab28a9a8a7595f5d66d999e7e
SHA1 4b39f70e8007d06c8191d4359627856c36c55f54
SHA512 15a3063e96a360a2dc81e11b693ccd88d7d0946e7a16753d8299c13db23add91496b674ffdc852c8d328a11b2659dd548ae5453a484b385474c85787f026b6f5
TLSH
T1DD811D6A43A0C6C6FF6243BDFAC068647AB042AB9C03DFE15140F9FC68D2FE91742605
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 26abae1043509ccf44a58aa4d47cf60daa3f74ebe9bb74174f1f46a2ee43ecba
MD5 fa15c221826caf52861390c012d46775
SHA1 ac1d0bc9cbcf7d1ad2966c3e5059c9f4e323952c
SHA512 e00b2ccd0e20958a9c7a69ff6443a7af3ca84080c2df6548f7112bf9b419141f4001e3659483589827be5ca8462bc03da31d2edb0e814e6ea67c956a8c16f2a9
SSDEEP 192:DIpcqrhsJm6mURaIfgETGoeTVws+KIdVNPzaPqvyfP65Hmzmrm7mDmOmR:DIpcqrhsJm6mURaIfgETGoeTVws+KIdC
TLSH
T1CFF1AEF7C3D8852DC90556F4AB256F1FCE2D1A24432C3C26C8D8BE5B93E2872D25265E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ff4b40cb7a00dd7aa825755c3390b0c7492bf81c151e3578cb1ecac0b56b85ee
MD5 c1cf64fe57af3b2df205ab183d740bb5
SHA1 4e4b0431448ebcaafd590fb7d602e7fee1bd7248
SHA512 671205740d8615225bc6fe9a8f9dcb971ba0c4611a81973c4da45ed189d3a403549b1175af0674097528b5151276ee9c866620da7080c4c4ec2051cc3347b8a2
SSDEEP 192:ZxRnqBwubp/fnlbSqEd34k/7v7cpAPRp2qg9BHsb+WNnnerB0r+kdkfrykw0aWPj:3Re79nofwUXlgrwE0a/f2UaiM8
TLSH
T1DE42C62FBA20647B5CEAD21AF9567B63D7F5102135912EC4EAFC8A2C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 36686b9bfbc9b48d621bc6cecdf91ac2287d1826e6ed5a3d9889c4f9a16f19b0
MD5 95c06be6e1f62c8bd85709c3ccbd96dc
SHA1 ff6a2e4f7b25273224eb0a4251a50d1bb668a4ab
SHA512 8706a50a33d8b22ff980c25d28112602be971c521a324f5c3015afd1cb9199d7c57262353783dd72bcf17b947de52afe9067379c5ab12ed40346e81cf781e622
SSDEEP 192:ZxRnq9cBzwubp/fnlbSqEd34kz7v7cpAPRp2qXneuSnOnGnj9BHsb+WNVn6nerBg:3RGmz79noTwUXl0rwLb2Apf2UaRMe
TLSH
T1F152E82FBA20257B9DEAD219F9557B67E3F5202125C12DC4EBFC8A2C15E76CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a362c0cca40c06aedd54068948bf9ee1de756a97eac2730a1d8e199315e065d1
MD5 8a27eb6833f7dcd9409fed956f8bd702
SHA1 4edb88259eef511764e41c6c43958100ec83003e
SHA512 cfb44582ab78a419e1f3b140f031395d2bf980735389dfe9a6220bd38c644fa4b3ff66f5b3234653776513f82f43298af292e6ffb34f502a6d72dec86890660c
SSDEEP 192:ZxRnq9cBzwubp/fnlbSqEd34kd7v7cpAPRp2qFnOnknj9BHsb+WNVn6nerB4n+r7:3RGmz79noxwUXlDrwLb26/f2UaiM8
TLSH
T1C852F82FBA20657B5CEAD21AF9557B67E7F5102121C02DC4EBFC8A2C15E76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 aafb69b26727d94b1b78f8da648e987fde9a3ce577d44ed680d169cefff0b0d8
MD5 d68a7678501117977d6ea1f4e68f8077
SHA1 5e1b026f0f34b485e6338e15bafaa14c28c4180b
SHA512 a24e07ffdc0bdf2c0a64c2e6ec40800abfece64f8c3a3eeecac8d55d02fc89d7eb16100cc44a86bdb6ef00e11be22722f4568e5c975c9ef9294000fcbcd59cdd
SSDEEP 192:ZxRnq9cBzwubp/fnlbSqEd34kO7v7cphuPRpOCqXneuSnOnGnj9BHsb+WNVn6neJ:3RGmz79noCwIXw0rwLc32p4f2Ua1Me
TLSH
T1D562E71FB920197B9DEAD219F9557B67E3F5202165C02DC8E7FC8A2C15E76CC2207027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e32342017784be7d5b27f098daa6f27f3e1fb08067c72e013b06fcd0ceee38df
MD5 743073a8fb2121295e0b0b468b936860
SHA1 9abf54a1f81b471a54620d7a6ce6be5d496a5c4b
SHA512 2988bd590b045235e764567a8b8d21f432662089f1129c82fcb7870614ff566e903d807bb54795b3b610bcada2e616ff3684829b8385bec3cc03da3ab7b342f7
TLSH
T140B0129080016145C41202F422422888B2349F20970E170163E06E228825590C1240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599968.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599968.TMP
Size 96B
SHA256 f34769a1a71a9fcd8cf98e0780e10aaf547104a96a3f2b4ad599e834e00b36d0
MD5 32dcb767ee1a7e9aa17e6d26fc4aacdd
SHA1 04e791f3352cc59fe31f9887360cf9326ec8ff76
SHA512 64d351b096a19d145ff640f6325c64dd661f11d43a26cc3cc7cfdbf20be9ae58037e859d63fbc474c7a7f859aa2df2f6b262c89d62e96140230cfaf24d7e0b85
TLSH
T1DBB00265C1066212D58603F52DD595D872E0DF25C603125BD2E02E66DD6A6A05629770
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6801be180e0aa2b67b29aafc7fe4c4bb9ba52c99cd2abee31df7e494104c3060
MD5 594ad922a1ad0889b49c3b426209f560
SHA1 21e3834f2e2fa24deb550a6a2f849e48ceb461bf
SHA512 f11041f769d5691b9355a7b3c0f059ff508780917c5915db583f614acb78a9150c823a2baf2842e9d6ef28f6b5719517fcdee938cc5421353daaeb53e8e709d0
TLSH
T10FA0025002D04847EC1A1BB4D69245E0B72048906341834344D408A9AE661D65322240
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 66b37160f8bc877664605ea6382abab972bd24ec36cbade0e743466d1227d590
MD5 1736964717c9134d8c49c51d581299b8
SHA1 0360c1d9dd01f476cd021e5e3a35499d34c00fe3
SHA512 7702e7936e4f088d9a8ba4ea1126258192ea4cc773ad7d6aa59416ed6a9d96bdfa2cb1ba4d09d36fcb713f3b12a39e7f077d30e1b65a3b018d147f1343af17b8
SSDEEP 6144:EB1tA3foEKFD6B3cFmUi21rSm8uUVNSlzY9:Y0i/fi21b8j8zQ
TLSH
T1C6341221ECA32EF57E967244F78F2A25ADBC5E410384C6445B620F192D5F3962B2FC39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 bf090444a187fc863a41f6637e1212ead823326b0cfbc7fb8bd3da2951b82b30
MD5 dfc0c41827a432782f5d1284ecdc42ef
SHA1 c51ef83acf40149de80bd53010a3081c9b9d834f
SHA512 7ac7dd0ed08e91f80935710aeabbfb23c39e5451f850c3a04e24519e796bc83e876e73863d262edaa4944d75b1be32f32d37f131069928e065d70c0f3969d132
SSDEEP 6144:D61tA3foEKFD6B3cFmUi21rSm8uUVNSlzY9:Da0i/fi21b8j8zQ
TLSH
T178342205ECA32EB5BE967254F79F2925AEBC0E4003C4C28557620F192E5F3961B6FC39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5a0f93f5d855eac8ebc3f070890b8ec82e4e0f4b92a2748cf98417d62c9af9b7
MD5 1e034d4e831e3d10dd76cec243324cdd
SHA1 0d7691a65e6c405611c639e643bc8858805fad7f
SHA512 9c72525a0ed26744afecdd1c808b3c84c80892d3f7cff015202ffbe13297b9f7b2ee312ba8932df38cc704069e7f7f6f19b7a960e7d093c84ad3e68a96792e47
SSDEEP 3072:SEFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:NFmUi21rSm8uUVNSlzY/
TLSH
T186C313007AE3E8F2FE5930447BEE2A149D6C0D818291C6415273AD419DEF3C61FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 4f9c102a1cbc85a81415c6aa465973cdbc79d9509fdfa95d06c22bbc9a7aa63d
MD5 56ed61025da9d0bbdd5be7ee4397fc6d
SHA1 d84d5c60d448e782f23b29468018929171dd5d6e
SHA512 3cb25fa8f4f1d7064e04acb99c8835b76c16c0eb9fcee3708edb15b834325ccf963bcf0843cfe7ff08bc739296a8e0beef03d2e0d97b688ee78449a7a51b813a
SSDEEP 6144:i61tA3foEKFD6B3cFmUi21rSm8uUVNSlzY9:ia0i/fi21b8j8zQ
TLSH
T126341205ECA32EB5BE966254F79F2925AEBC0E4003C4C28557620F192E5F3961B6FC39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download