e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
23/07/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avcodec-51.dll
Size 4.2MB
Sample260723-bdevlsbr3x
SHA256 e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702
MD5 b66478cc0f9ec50810489a039ced642b
SHA1 992ede70f0fee5cb323b4b810cc960bf2531875e
SHA512 ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645
SSDEEP 98304:UyIwuFFZZqniDGDHt+elelHjzMvIOFXEkGP0P7g+r0ZpSHA23yQ7D9cpTZY:UyIwuFFZZqniDGDHt+elelHjzMvIOFN1
TLSH
T11C265C85F6A380F6D8470C71902FF37F96392A08C525DFA5EFC02F59F9A2B529856306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292421022792246"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe
Token: SeShutdownPrivilege	5208	chrome.exe
Token: SeCreatePagefilePrivilege	5208	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe
5208	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4220	4364	rundll32.exe	86
PID 5208 wrote to memory of 5944	5208	chrome.exe	89
PID 5208 wrote to memory of 644	5208	chrome.exe	90
PID 5208 wrote to memory of 644	5208	chrome.exe	90
PID 5208 wrote to memory of 4524	5208	chrome.exe	91
PID 5208 wrote to memory of 3420	5208	chrome.exe	92
PID 5208 wrote to memory of 3420	5208	chrome.exe	92
PID 5208 wrote to memory of 4820	5208	chrome.exe	93
PID 5208 wrote to memory of 1256	5208	chrome.exe	94
PID 5208 wrote to memory of 4820	5208	chrome.exe	93
PID 5208 wrote to memory of 1256	5208	chrome.exe	94
PID 5208 wrote to memory of 4040	5208	chrome.exe	95
PID 5208 wrote to memory of 4040	5208	chrome.exe	95
PID 5208 wrote to memory of 5708	5208	chrome.exe	97
PID 5208 wrote to memory of 5708	5208	chrome.exe	97
PID 5208 wrote to memory of 3432	5208	chrome.exe	102
PID 5208 wrote to memory of 5736	5208	chrome.exe	109
PID 5208 wrote to memory of 5736	5208	chrome.exe	109
PID 5208 wrote to memory of 2340	5208	chrome.exe	111
PID 5208 wrote to memory of 2340	5208	chrome.exe	111
PID 5208 wrote to memory of 5384	5208	chrome.exe	114
PID 5208 wrote to memory of 5816	5208	chrome.exe	115
PID 5208 wrote to memory of 4812	5208	chrome.exe	116
PID 5208 wrote to memory of 4276	5208	chrome.exe	118
PID 5208 wrote to memory of 4276	5208	chrome.exe	118
PID 5208 wrote to memory of 3048	5208	chrome.exe	120

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9c6bac728,0x7ff9c6bac734,0x7ff9c6bac740
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,8663262830418278508,2108101513622672154,262144 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,4949626692591884207,17500703830061701192,524288 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,15981349762542701874,3986202153979505517,524288 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,11174675811855369857,11749664419062593892,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,14364176280457765426,2416903524313643941,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,1026374405129622351,9146608179086617665,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,16344902626128228373,4842086776917255362,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,15541587314112476726,15274923903945049170,524288 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6092,i,9942160807908466994,10125660561377780628,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4912,i,4714713099317346942,1037853580649214720,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,7094448964852056612,11452838771762812311,524288 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,1595544773540764776,17006059225767309772,524288 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,10272325669023155510,8374513516659866555,524288 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4456,i,1882036341242515079,13590485919985865857,2097152 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4524,i,15068258531137774908,14273570047993419873,262144 --field-trial-handle=2112,i,17250222937590700424,12293553698783472835,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cb70c7a072b9708e9cd87c053157fdcc4e8ff6fc29ee49570d4bb81a4d2e788c
MD5 a2a8722c93d01137666b30cd849634a8
SHA1 bf38b6d121f1e2cd6110ff6a059298a809db33b2
SHA512 39de409c3500157e7facaa47658288257440823e517dda59960f681d35c6abaa846ba6bd7724b46a39a63db633d213ca41f12e7af6d40b7d00dd67a3952a9d87
TLSH
T11DE02BAECA61DC370DFD071DA0500745E65413573B80958B3B3C86084FB463A838AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1f80a1bd976a50742f88a532f2ab88bc0175b02011f5d9f9d34df8cc7184a370
MD5 c4aefcc4e61eb36c13ab0a8513ea1034
SHA1 0a146c69ffccb6e69c11baca28e5351af5d662a9
SHA512 e95c0232469b5601dc76c330c4ad323b44d8fbdfc84eb8d403de3a4055e1ee421782ccb0e3c055797c5f8224177e49348cbba23e7504a4e12d29ad7754307212
TLSH
T17341E9B11758CD81EF19DEBD4782DAC0B02E212D2E6F5F7A834311613B637DD09E2046
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e0133cc7b5e0e49e76f6f74ff10e16b3034130ce6aacd825963e159eeb7ee329
MD5 bf5a2fec879b0ed32395c81c7be61e4a
SHA1 680de9a2e9464cbe7b94cdd69a06cdfae048e30e
SHA512 8607083696cf18926994a70b8b3a1b4ef4be29f6448ee1c3d962aaf3c2ee25f6849b961d853e9da2bda647e92b37ec2e39917c493c1b3fc257529a8c3d66d9c8
SSDEEP 192:Drss1TxfjskvE4taawJP5aLW4TjhT2IJyOIjNglqKVsltfNkYRp0H:Drss1TxfjskvE4taawF5aLW4TZdJyOIw
TLSH
T10A129FF7C3EE962DC81251F4AB14AE2ECE6D1914832C3D2A88E4AF4B57E2571D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 33c010fb44b90e2ccd49137977f034ae6c84fa9acbc0f41b2aff63b6de9c5169
MD5 fbc4efc02653389e113535faa79bd614
SHA1 652648655e09f917c85f4b082c317ee91a14b876
SHA512 b1875fa5db8be1d39bb31d4dd1f9b129e902293ec59f640a5db0183765efb804a0bc93f704bc02e807422e8cdcbea6ac6810c8900d2189427984988017d101c9
TLSH
T18561BEF7C3E8867D891152F4EB157E2FCE2D0925532C3C5288D4AE5B63F28B2D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9f4ee7da75819dc52ea834477befc1b393d42b356a648f2c3203d6d859f17c36
MD5 98074a346b63c3fa9fd5d06405f39b6a
SHA1 e2736bcdc27d417f36422942ae40f78ccd85509d
SHA512 f41bd8411933deddb0a0dc93c3ffebcea744f37867534566030053a8fc84ea5a80f5b4c2fa8100b9a97935c20e6a019589983bda3cb69b83b014c0128b290d6c
TLSH
T13E61BEF7C3E8867D891152F4EB157E2FCE2D0925532C3C5288D4AE5B63F28B2D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 262505ef4bb18b4f5a6fa7022888d0d1a1538f6c4315d2c211bf1b994af7007e
MD5 7fa12cbf47456a975ec16ded7202002d
SHA1 910eb6834eb7fa7e032ed57b41e02b7d5565e511
SHA512 e114a44a72374060c555a577c8e758cb260679be04b815cf0f7fbbd1db6a119231ff9b11bbabdec494051108bc9399c45e12f913fdc3f948177cfa70e3715cde
SSDEEP 192:FRXxyt/nqbQv71hhAPRp2g92Hsb+WNnUT0mbNkwtja3+VyIsnAUgtaJ:FRXx6OMBh8XDQwc0mRa328
TLSH
T14042D52FA920A57B6CDBD22AFD117743DBF9112121E52E84E6FC8A1C14D71CD622B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b860a513962a1170d0117f32572ce77dc4a420766bb5446f2c68f5644270b7fe
MD5 ea73e7672ebe95d2dfcb46aaaa0c0145
SHA1 7e1f59e9357d4748d8b56bd9c7cb8c9f20ff5de7
SHA512 4bc27e4f5893f325f67411b96d4a4bd38bb2a65e2a409b355805d61964e8df180a7b1ba92017a0cf58e692231de9c2333c1520cf86b15949846ffeb854fbe606
SSDEEP 192:FRXx9t/nqbXv71hhZPRp6YiC92Hsb+WN6nQUT64v2NSjbNkwtjaX+VyIsnAUgraJ:FRXxLO/BhrXLQwCR2QRaX2e
TLSH
T15452D52FA82065BB6DD6D22AF9117713D7F5112162E01E84E7FCCA1C05EB6CD622742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 003fa3b86b44688617b6a25a06f2f4fe65e3955e0abe56fbf2ce397c7c178dfe
MD5 e869940bcba8fd8412aa7038ac3218be
SHA1 e453ab813a6d5a140ccf26255a971e4371a5335a
SHA512 02a309b349dcd9f9ea15da5b8f961c794cfc5dbb6b9ee8d4dee7b7e7267ebd195faf0571ea1d3004fed492b6221884d850a850c251b47f42bcca9d0ffe3483da
SSDEEP 192:FRXx9t/nqbKv71hhAPRp2zC92Hsb+WNnUT64v2obNkwtjap+VyIsnAUgraJ:FRXxLOGBh8XNQwcR2wRap2e
TLSH
T18252D52FA920A57B6DDAD22AF9117703DBF5112122E02E80E7FCCA1C15D75CD622B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 cb2e27ff5de92b330d7d75ecf81e90b61c537659f1de9067eb5c6be59f79aee2
MD5 e332644520151389425b97429d3a1d0c
SHA1 5d3057a3e7d17042ef167328c594fd87f02498dc
SHA512 9133ff50322f746e44dea031f154d6d3e61cff5e56966abb783aafc27168785f3f2b3e4ce4d1ba8052fb79650ac10c046302b08cc12e2ca7f4168e56d0217dec
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLkdLcSjwxXODKh+ErU3wZ6Hw/A1iIp:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG6972
TLSH
T1CF7209676C4C8E770F94C68DEC177B4F9DB5024B61EA886483FA982503D5BCA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5ec163f3772feb6341c1476f5593f1357ee1813cf5ccd3d88ae5689fec6483f0
MD5 5aa901798e0ab3293992c097f09c8efd
SHA1 b2d3099f4667ec14a68051bde5d0179ccb9ff694
SHA512 60e382ae890418cf3e9bf24e3d835ba18d6d7b8c55b2e094458586c378cbe9bcb192d21e316963645189721dc51382eb6a4c62d63c240ad66e68c1871870044f
TLSH
T1A1B0125090415181C04202F4114258887314AF10DA0A3B0583E47A7288251548215090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589601.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589601.TMP
Size 96B
SHA256 97c02da4f91fb7ebb09840649ec9dae820ffd0e156949db5b111387d978a8807
MD5 2ef18d832ed9b799a3f9312a1fd6802d
SHA1 2e16f156910613252d273dd2e838be81d75b1500
SHA512 7e13f08e9322ec58439032f3248cc394b1ad920e302192f06c6655b03fbdf5d2dd16bca4397726daae2fa122319fee45bc73df6a5cc119f2cc583f783f57ae46
TLSH
T1D6B02202C0023202C00203F028AAE0E83030CF30CA0302028BE02B22CC232300AA0BA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 ab37822459b862a26cb8d0fb5b64ab0dd3f1c294adf17ffbf4a4e19874370593
MD5 cbd2f771ed977e8e024d5a09a788a893
SHA1 0288cf8e2232ba19b4322d49cfc984828e397dba
SHA512 2ee10467d319171d98fef650a0dfb7b0d5ff95b00c6e148735ecce817d5356485df96efd07a7e1ffbecf168443fb60e514e3d5707ebc7e9df37eb0257cd9c475
SSDEEP 6144:F+rj1Xr2MFVM+apBFXm7Rkm1tYpBeh2BAo5:Qn1Xaee+YF29oBGcAo5
TLSH
T19B3412379C31AEBA89B85719704E171F1DB095D74C20EAC29DF86B0823D72818A0BE7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 57088b4e927cf391f032341258d2afbaf2c8ca8758e65e5a581b1e75398fbd96
MD5 51e908a0e4d59aaf1c5f7cc9229ca30b
SHA1 8cefcab4387f55b1430750b57d0d1331253e0858
SHA512 8fee95f2b725e9a0e31cfd2297926321f14cd78cf981f99986564511669e36044e36c80ee08c91a31494aa44d4135e7c4bb9a24c4a1d0cceea615edf22e2c9c1
SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Sm7Rkm1tYpBeh2BAo3
TLSH
T197C312275D71E9375D79A74EB08E0B1F1EF14AA6C930DE92C8D86B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 a2468628543a9e21059bafbf3db933c9906ad02aca86c73fc887c9619e4a35a8
MD5 c5fb3ecc60e0612c50e36eb7edad8858
SHA1 ceed097a0cca648c9f685b223fe9748a90448e32
SHA512 9572cfaf85464de9856722cb319ceb707dc3931d0b91194180805c8576bb4638dc3fa3ba2a1a45bffd84137a0496112595a752a03220de2bf83c91e1d2100278
SSDEEP 6144:l+rj1Xr2MFVM+apBFXm7Rkm1tYpBeh2BAo5:wn1Xaee+YF29oBGcAo5
TLSH
T1643423375D31AEBD89BC571AA04F571F1EB045D64D20A6D39CF86B0823D36818A07E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c8f49aea7fb2dc5e38339418dbe93a0d38a3fb13d2c0fd30a4af842343e7f368
MD5 fcbd91157087e1b03aeca28a8ec12832
SHA1 144d3318700293354711f51db4aa51f930c2c773
SHA512 d1a218b6233f7bfb920719fe3b1a0b8e927243d1060e1181ed92495161ea7ec075d75698974195fd6c83257143d0ef69ee4c660e274fa93ef70d5fa59186c896
SSDEEP 6144:g+rj1Xr2MFVM+apBFXm7Rkm1tYpBeh2BAo5:1n1Xaee+YF29oBGcAo5
TLSH
T1983423375D31AEBD89BC971AA04F171F1EB045D64D20A6D39DF86B0823D36818A07E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4220-384-0x000000006BB40000-0x000000006C219000-memory.dmp

Download

memory/4220-0-0x000000006BB40000-0x000000006C219000-memory.dmp

Download