hxxps://syllabusx[.]com/terms-conditions

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://syllabusx.com/terms-conditions
Sample260804-22b2qsaa96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5180	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303583036650996"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
5544	chrome.exe
5544	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4192	4700	chrome.exe	88
PID 4700 wrote to memory of 4272	4700	chrome.exe	90
PID 4700 wrote to memory of 5180	4700	chrome.exe	91
PID 4700 wrote to memory of 4272	4700	chrome.exe	90
PID 4700 wrote to memory of 4992	4700	chrome.exe	93
PID 4700 wrote to memory of 4992	4700	chrome.exe	93
PID 4700 wrote to memory of 1372	4700	chrome.exe	94
PID 4700 wrote to memory of 1372	4700	chrome.exe	94
PID 4700 wrote to memory of 5672	4700	chrome.exe	95
PID 4700 wrote to memory of 5672	4700	chrome.exe	95
PID 4700 wrote to memory of 2552	4700	chrome.exe	96
PID 4700 wrote to memory of 3728	4700	chrome.exe	97
PID 4700 wrote to memory of 3780	4700	chrome.exe	98
PID 4700 wrote to memory of 3728	4700	chrome.exe	97
PID 4700 wrote to memory of 3780	4700	chrome.exe	98
PID 4700 wrote to memory of 1288	4700	chrome.exe	102
PID 4700 wrote to memory of 5912	4700	chrome.exe	103
PID 4700 wrote to memory of 1288	4700	chrome.exe	102
PID 4700 wrote to memory of 5912	4700	chrome.exe	103
PID 4700 wrote to memory of 4668	4700	chrome.exe	105
PID 4700 wrote to memory of 5084	4700	chrome.exe	106
PID 4700 wrote to memory of 1688	4700	chrome.exe	108
PID 4700 wrote to memory of 4448	4700	chrome.exe	107
PID 4700 wrote to memory of 2120	4700	chrome.exe	109
PID 4700 wrote to memory of 4668	4700	chrome.exe	105
PID 4700 wrote to memory of 4448	4700	chrome.exe	107
PID 4700 wrote to memory of 5700	4700	chrome.exe	110
PID 4700 wrote to memory of 5700	4700	chrome.exe	110
PID 4700 wrote to memory of 5788	4700	chrome.exe	111
PID 4700 wrote to memory of 5788	4700	chrome.exe	111
PID 4700 wrote to memory of 5544	4700	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://syllabusx.com/terms-conditions
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb25b6c728,0x7ffb25b6c734,0x7ffb25b6c740
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,13739389332261330563,16895494099937704308,262144 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,13913571087391423289,16685527843689788812,524288 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,3020733178629927429,8403047208949789323,524288 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,7585058431810084470,13954963757627284649,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,2706992019610762647,14537128809610248086,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,15522328952519622183,18129933583729567665,524288 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5660,i,4208523422983771532,9991312423359335386,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5680,i,5970648608290695423,10866169925904306954,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5948,i,7910784653176962725,14917867291727531349,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5728,i,593225917151516324,12919524120005450892,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4708,i,4498271952651978478,4088433602309294775,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,15228577594519860860,16991381701161008139,524288 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5808,i,118904463771501380,13604049062348403981,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,68016208628762979,14837095784943288817,524288 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,6394985273705241339,4004177805884287987,524288 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6136,i,15948224929148197912,631704403112860619,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5984,i,2947802742092541865,13903800667014875037,2097152 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4884,i,9454296648031191353,2075864778947106366,262144 --field-trial-handle=1912,i,14461247476594260413,13717533842022646029,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

745e351d-54f1-40d5-9690-192e60c2d335.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\745e351d-54f1-40d5-9690-192e60c2d335.tmp
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d152538ba20675cfc673d303522cf5eb05f1cf2efb96f1f05b5c3ce77c74a130
MD5 38110f96bc0a39400282d6aaf0af67ab
SHA1 15684e817f89d64d5da8ea9d8e5486d1b5f93d94
SHA512 b60b0fb688051e9bb2cf2495fc64f5511e20fdb8a3d1e40087e3267e4dcd8f646bbdfd2e9480dea951973c7259a1e84c424457a9de5727d2c775c595841e8a90
TLSH
T1AFB0120853C8003DCF800676C04309902C7016F40031171BA2C214AC94772F0870045B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 c83a32b6cfee84bc4a542a3e9e42a5a75d0d571b385fc159e8aea384824e4109
MD5 9e7814d5bd6426caeab7ff1ffa3dd78d
SHA1 cb221acdd74e75b5e3ff3c899ca21f13dcb67764
SHA512 df020a422fc1d42b2d72b4c2e1554b3b7164db18ece5f7fe8ea27c86c50ce9410eb999ff10422953d5b4bdc3040cd22bfd6549782ee8d2f8183cbc105593711e
TLSH
T199D080557383531DCF10D27448F20E45F9A2BAF5DDD0115B5F90605F45371F54041755
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9f1ccd4b5fb928e33778508a04f9cf5704245c5ef600e36da92a868830fbb6b3
MD5 0d1517dde20a66580a85da54dac230f0
SHA1 5305284c5f3f95e5d7df80e4c0c0aef72f17aab6
SHA512 75e9a7585d300a82c15aec790daf4df280052f42c3b2eefaf5a500fa7174bc1c6171274d73b8ff1921be36c26e7e10f33d9668e79e0c1b8fb9a701f32a6248e5
SSDEEP 48:YALlUeUvU4UUWPh5sJnRsJ+iXLsJyfoKsJGfsJcosloAslFosx1MsQN1xJzsBMda:DFGNl+0YJDnGbh1kN1zGmURfJgK
TLSH
T1C0A1BDF7C7E9D62D895556F4A7146E1BCE2D0A28432D3C66CCE4FE4B63E2471E20064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 46a7b8ad2a969140b019a67b902e99aae4ff2feb29d8480c0a2531074906db0e
MD5 f99d918069384ab4e0a7e40258f8408d
SHA1 348b6ee8cd0f104ab96affcec8eece272b69b54b
SHA512 cd1b2f49f055c942bb93b39a97cb0b5a577b7ec5736211585e3d94c439e10c7240e29b0ef591935228bacddbdc862d629b88016d308c59f04b7bd9599572c370
SSDEEP 192:yRvLAhTv7zvAPRp2qt9EHsb+WNnFXQBu2qYye0Mz2K8CVyIsnAUgR:yRvLKr/6XBmw1J2qzMz2KxR
TLSH
T18E32863AB910693B5DCBC22AFA257797E7F5102265D02E84EBFC4A3C21E75CD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e42728352417e16cfc5ef789731ac9111c4dd33282e6262284458401b821d9c7
MD5 e4348212273025bf4131a5d8e155d401
SHA1 bb7411e43bda570d55425cfc11ba82d50aed7b43
SHA512 4d7e5f29e6aaab892465f314b3f60bd60b1fbfd96ec7c3da29f07a8e62717e88fd7d057a602fab537f10e5825ee1af1b6e5352b6dfe3e7ed03769ea91be0b20b
SSDEEP 192:yRvLAh6v7zv+PRpIqO9EHsb+WNnFXQrmXeq/Uye0Mz2K8qVyIsnAUgE:yRvLKW/IX0mw1JeqXMz2K/E
TLSH
T1E742972EB9106D3B5DCBD229FA65B753D3F5202265902E84EBFC8A3C21E75CD2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4966db975aec700e742025d75c6fbaa511671ec4928f2acd4b8abb7cf03adaa8
MD5 10647317fec9a0e51388a28f350802b0
SHA1 762b375e61b2d7e986694593af6841ff9f7afa09
SHA512 55985abaee43c8b3fa1969333736a89a1384ab6eab81a62c988e05fb95c90c5618de5865e969707dc72bff730fab0579f28a26fc41f25783034b3faa49feb62f
SSDEEP 192:yRvLAhBv7zvAPRp2qt9EHsb+WNnFXQBu2qXye0Mz2K8uVyIsnAUgE:yRvLKR/6XBmw1J2qEMz2KNE
TLSH
T1ED42863EB910693B5DCBD22AFA25B757D7F5202265D02E80EBFC8A2C21E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 57KB
SHA256 e210ed017d967003ec2f7a785f8392c2d22303a7af0b3c5db73896e6c5f3db47
MD5 c975857801afc5fc142b20bf251b1940
SHA1 f10eebe1ad66ab1acc4f1aa8aa7f181b75969771
SHA512 314a6d62a3a5d43828472a1ae2a23ae090610f79112e972d5e78048c00c371f05e381213c948af4e4e485968ae82667599907beecee9fa4cd32fea48fafdf9aa
SSDEEP 1536:WGPMfIkLRectZZ2l/fLFckbEKZmGHJOcldK5:3PMaC2lXxcmhM5
TLSH
T19543013091046D25DAF3A32254675943D54F21522CC52DAAEEEC3FB921E27C7E88737E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b8a58acba79e3014df912c39ce6e698b9330b3adf924ba42fcde10a3cc25c90b
MD5 784ff54fca3b39f10bffae7f04e05fb3
SHA1 200519a9f4a3fbf25d50fe97e052517be1002fdb
SHA512 2f31bfd06ab886904258773490a5cfb1691ecbf77fce20a2b479359754834478aeb00539a544b2034d8d211389a1c92a55015affd37eb85df13170ddb786711e
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbqR3dSl8h4otop5TNDrB6UGyvnpBkeSr2UZ0jx:xC0PtbKFKu00UUSbq9iU25VUMBkxr2Ui
TLSH
T19AC129B2A8689C7399F6D646B5032647CEB46167AD819FA4CADE0F1C01F70AC234353B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6ce37f6aed096b655b4b8a483c7c13a1e87996e38fccace5a6a93c2661667873
MD5 2e3f7d12a2349d8aceb442078111e2e6
SHA1 161c4c586da4316a886f2eb38d9a26382a7f9bf4
SHA512 c3b786c4c6a0bfbea7310cfb7b6cc3a7aa413cb5d3d43b093882d2a55739b861b41a8233cc0d75608a118e68a4ee1a42669b675fe27caacdb373ebe9a43e1b82
SSDEEP 96:RbJ0d+EZUAbKFKu0d6aF7QuGJfmbqR3dSl8h4otop5TNDrB6UGyvnpBkeYQ2UZ01:Rt0PtbKFKu00UUSbq9iU25VUMBkhQ2Ui
TLSH
T1BFC12AB1A8689C7399F6D646B4022607CEB4616B9D819FA4CADE0F1C01E71AC2343637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 86c6e9b9dc6c677028971f605361e6a7b87bd85ecdd6ad651c8ca785e6d8ac63
MD5 39b56e694f9434ddded1c4f53dea5a0a
SHA1 2d8a0725568fb45d7ca20faf64ef52c44065a02e
SHA512 872638b826f2c35790cc89dd057bdf75193066f186a977970467bdd06ef2cf5d729b9976798600977c435dfe1e0f2c9ecc2b4da71650a42389f6026d2a92a694
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5TlDrB60GyvnnXUlbKmb0v4a:xC0PtbKFKu00UUSb/iDUD5VECXUlbK7
TLSH
T18AA13C72A4698D735979D64AB9622A03CF79F02B9D229F54D9CD0F0C10F70EC1342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download