2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aurora.exe
Size 108KB
Sample260724-c7vctsfm21
SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
MD5 8ce68a756995deb55746dee1525edec3
SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
TLSH
T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1436	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293346395285783"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe
Token: SeShutdownPrivilege	3540	chrome.exe
Token: SeCreatePagefilePrivilege	3540	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe
3540	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 684	3540	chrome.exe	88
PID 3540 wrote to memory of 312	3540	chrome.exe	89
PID 3540 wrote to memory of 312	3540	chrome.exe	89
PID 3540 wrote to memory of 1436	3540	chrome.exe	90
PID 3540 wrote to memory of 2060	3540	chrome.exe	91
PID 3540 wrote to memory of 2060	3540	chrome.exe	91
PID 3540 wrote to memory of 3460	3540	chrome.exe	93
PID 3540 wrote to memory of 4240	3540	chrome.exe	94
PID 3540 wrote to memory of 3460	3540	chrome.exe	93
PID 3540 wrote to memory of 4240	3540	chrome.exe	94
PID 3540 wrote to memory of 1176	3540	chrome.exe	95
PID 3540 wrote to memory of 1176	3540	chrome.exe	95
PID 3540 wrote to memory of 4540	3540	chrome.exe	96
PID 3540 wrote to memory of 4540	3540	chrome.exe	96
PID 3540 wrote to memory of 952	3540	chrome.exe	100
PID 3540 wrote to memory of 952	3540	chrome.exe	110
PID 3540 wrote to memory of 952	3540	chrome.exe	110
PID 3540 wrote to memory of 4560	3540	chrome.exe	111
PID 3540 wrote to memory of 4560	3540	chrome.exe	111
PID 3540 wrote to memory of 4332	3540	chrome.exe	112
PID 3540 wrote to memory of 4332	3540	chrome.exe	112
PID 3540 wrote to memory of 4884	3540	chrome.exe	113
PID 3540 wrote to memory of 4884	3540	chrome.exe	113
PID 3540 wrote to memory of 2340	3540	chrome.exe	114
PID 3540 wrote to memory of 1628	3540	chrome.exe	115
PID 3540 wrote to memory of 2064	3540	chrome.exe	116
PID 3540 wrote to memory of 4260	3540	chrome.exe	118

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
1⤵
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe5903c728,0x7ffe5903c734,0x7ffe5903c740
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,10560423667188425500,12816224623525930716,262144 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,14276793504109076994,14928795597749700632,524288 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,5654822262015053692,8533632347942460409,524288 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,18345589765226692217,13205573527449031478,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,1264891090604730814,15100232757022957055,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,13449420947568750012,17782314807611107108,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,7741796910100181409,12070952933683149384,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,1612076724600949482,5253846057293664258,524288 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,4618883858680209829,1430299109836474521,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:2
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5908,i,2814197169475166321,4133908678244034286,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3496,i,9973410364200078022,16331615486172943041,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5828,i,9299040989933176009,16466983041096690837,2097152 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,16321248801465864861,14716128246421240041,524288 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,10382575505100148265,14111291860210537805,524288 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,1454337864443843866,8719504683965243441,524288 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5744,i,8681990643829279773,4934231565292504929,262144 --field-trial-handle=2036,i,4474263382108213651,13573038781920497797,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7cc77c98318ffe97f161a241db849681248ee3dc414cbed6832637f9dd15b9c9
MD5 5e1462e8d40049e5b53e0640d618fcd6
SHA1 dfe2de724295be3ef3e7cdb818ff8eb7f343012a
SHA512 6e40a3b373a23fe55fb43a0ca755dea3f571e27955f435ea1a6dcf33b96c36f6a59c4fc7059c314b2dad36d9ab3fc379f6ee7e6d8b8771990da39a197c702486
TLSH
T138E02B6AC871DC2B14F90B19E0546746EF65139B2A80894B7B3CC10D8FB16364686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 51bfe241ed6f14d173a8774c666dd973d42bee43ec1ac54d2cd5bbe927e6cda8
MD5 73561afb7e3cc0ad83ed95b8540c83de
SHA1 7e45b55b4a209331214fa5861185bc5089f9360f
SHA512 357c7bbe796e02d50b8e03b4c3089fdc80e315858d7d1c3179d98cf26e41588665e6b9eeba9054cf12e6b831e4c1ace985dac2403e2ba1b50b1dfbb5517af3ac
TLSH
T1FBD080025E441771C3084133D05D70B031B1C5D9154904D75391F69B38505FD0D51860
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dbc533077025d746b244502c18727d1e96b07ac6505f923b66edd5758788fbc7
MD5 8f2c1bc1361d0456318d3f484f307338
SHA1 e98b03b1eced02b8d0f2d117a34ae9378d17510a
SHA512 c926617c7917b231e61e890066596bc07cffbb0b155e96854f387f507b5b066f57ddcee05f7bcbbeba86d73cf60d133b4884d1058a6460a908df7717b03e2736
SSDEEP 48:YALlq1qHhGhchEhS2aXYfoKs5gmzsJvBseHosatszucsCPsD+ss4sbfsdosJ/Da:D22EeyLaISm5qquWOubUl2
TLSH
T14E915CF7C3D8852D891156F8EB156E1FCE2E0A14432C3C66C8D8BE5B93E2872D21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8fc8431b3a6aef96e4156c530cc43b8646cbf7dbca0455db04abef74e08c96de
MD5 0720e149cbe7292e5563b72248ee43ec
SHA1 f95532c6fca06ed0fa5b8c0a9811ecea87aad585
SHA512 4ae7ecabf87b9060050fe326613ae16254a6c918c9e1204fae7f059e2641949e6e4e17a644ffac799b547d2bf83440c9766385972a328f9765eacc3483203077
SSDEEP 192:XRgztjEQFR47kkav70pdPRpxdQn0Y9+Hsb+WN75aoFGE2GiZkSMkwPf+VyIsnAUp:XRgzWyE2gbXg8wHr2GqkH2e
TLSH
T1E252E62FAE10597B9DEAC625FA11BB17E7F1202265901E84E7FCCA2C15E76CC221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7bd688a73dc8669389611cb429d215bc554c898986a04aec21909b1d6b775cc8
MD5 72001c3c046fa176034d3c928ae86974
SHA1 e8e8a76d42996507b1bc0461ee931d2560df72d6
SHA512 a2b78fbe1ddd116c6fce9d684e0233a7fc8736ddec44245deece9a522557bc19c61510778462997622751dd162e00d8c6975d523647dca3b40843d83f02b701a
SSDEEP 192:XRgztjEQFR47kkzv70pAPRp2dQn0Y9+Hsb+WN75aoFGE2KZkSMkwPB+VyIsnAUge:XRgzWyELgUXT8wHr2SkZ2e
TLSH
T1F452D62FAE10597B9DEEC215F911BB17E7F2202265911E84E7FCCA2C15E76CC222705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7ab402e011ef2f134217b4c25c434af834fec43cb972c87fcdc896dc2caadb13
MD5 1fcf581f1c8e4d3b8feb0d8911608a64
SHA1 512e8f3f9b474cba05b4d82135f2e862471ab34b
SHA512 2e1975a8a06675316df2b30abea575071e574d51efb934670482ed6063bccf88bf7ace0e23fefc2f73b5791450407780adba212576ef45cb790128478f425133
SSDEEP 192:9RgztjEQFR47kkzv70pAPRp2dj9+Hsb+WNnMC0gIZkSMkwPJ+VyIsnAUgtaJ:9RgzWyELgUX68w90g4kR28
TLSH
T18F42B52EAE10697B9CDFC229FD617B13D7F6102265951E84E6FCCA2C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 75b629e598cf54264959afa40112dd071d478dfc2be9deeff702d56a2576bc74
MD5 2b9aff2d1bf22592b5902331d1388134
SHA1 f7bf43bd2172ac7c0bd4a8d8df5240f3cfbe0745
SHA512 2e2ba958d119ee6109eba7a63beed72d20d35fbdb814b22880e3c78a7006815b4d6d571342886c0081935223a4551b812844ec336bdb3a74276fac5e734e70f1
TLSH
T178B01201C2425201C84203B021422498B1545F24960E1B0143E46E22C8351B1C519050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca9e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ca9e.TMP
Size 96B
SHA256 7d1ca4904e2735428636f9e9612f82e440fff2d0edbe88d246af26fe05c4cb84
MD5 a6cc5d0d0bb07b412139b33209146059
SHA1 6e05afdeac668e3f5cf7a579df4f161215f341f3
SHA512 38ebb18b8693cf5f477bb9f73f8b41aa1db40d9a086bf248251768f95098fe67f4933b06053db0d762b87d45101ab16544947d145a6c60a2b0bcaa0014a33ece
TLSH
T18CB02202C002A202C00203B0228880F8B020CF28C383030282F02A22EC202B088A20A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 45a2bb1863e94ad02f789661168ed389e3092ce725233de82b1f4e062ead1f6a
MD5 c2e14d7405bd866f6e0bf2710eb264d0
SHA1 81e619d7644f6825ec9cd01be5d23e45c6a3c665
SHA512 7d1126c96f221d61ed8ef1ff797a1fbbfcff0502d2849f8477fb6415170ff100069576dd8eb3cefd3a6056caa1d14e94259af5c0f2f3f85d248f0bc2eb0429b7
SSDEEP 6144:bEV3KhXHya6x41Ktmj9JA9YLP7c0lqZ/ZLW3Ex7:G30yaz1yaAAg0lqZ/piQ7
TLSH
T1D2341376AE539E374D8B8725B2125FDA5CB5585EE030C2436F78332BBD829E0A907D4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8d6a106e235b8d350e9bca5dbaa58cc0ca96c2a478e6d8cdda03063c6173bda7
MD5 3b60d5e35d7022f2f23ca7df1481b586
SHA1 0b45abc7402519168868f3ce3d657847bf79cebc
SHA512 44d40a4b292983aa15b04ad3203c667a2b3c24c49aed32349d7dac528104b8093019d7ed55a8b0c86628a123d8f26fc30fd3fc85ade33c497610d9be27bcbefa
SSDEEP 1536:bbLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:dqfd7NtZL8cHQRZEQ6Sps3
TLSH
T180C30237EBC25F339D92CF64B9130FDA67B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 50fd7555003d436c750add913bb54ec019aa9810cc7fa4f359dd887d24874c1f
MD5 44cfde52de1386b94294a215df666f9c
SHA1 00757cace9677cc0bb0bc22ef29672fc8e468c1d
SHA512 8eb64f300c84541db1b4edb199c2301856421525fea501c18b8c9239ea14f1f0a86f7ea06511fc714c691179ce0955240776e8b0b231152e346fc160b7107f80
SSDEEP 6144:CV3KhXHya6x41Ktmj9JA9YLP7c0lqZ/ZLW3Ex7:s30yaz1yaAAg0lqZ/piQ7
TLSH
T1CA342375AF539E374D8A8735B2525EDE59B1186CE060C2436F78333BBE829E0690B94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f90ea3aff57cf3a5394d19bbb7d93831288bb200e2fcc32926a23020afb731c7
MD5 333e7df3ac623a78ea33a41f0ec9d947
SHA1 2d43ba2b9be046d5d4dcfb75ffd540abfb386ba6
SHA512 f56eb856d7513d553ac7f73bda0bb6341bd5da96986023ee8056e0c6fbf7ed451640c4b986a73ac55ad3b642b599ae48f6667db18e1ee1629d0950139272e439
SSDEEP 6144:tV3KhXHya6x41Ktmj9JA9YLP7c0lqZ/ZLW3Ex7:X30yaz1yaAAg0lqZ/piQ7
TLSH
T12A342275AF539E374D8A8735B2525EDA59B1186CE070C2436F78333BBE829E0690B94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download