hxxps://mautic[.]ssessments[.]com/r/75b83926d7fbc31080fd4c66c?ct=YTo2OntzOjY6InNvdXJjZSI7YToyOntpOjA7czo1OiJlbWFpbCI7aToxO2k6MTAzO31zOjU6ImVtYWlsIjtpOjEwMztzOjQ6InN0YXQiO3M6MjI6IjZhNzM4ODU3NDk1ZGYzMDI3NDI3MTIiO3M6OToic2VudF90aW1lIjtpOjE3ODU5NTY0Mzk7czo0OiJsZWFkIjtzOjc6IjEwMDQ5MDUiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjEwMzt9fQ%3D%3D&

Analysis

user interaction
yes
max time kernel
899s
max time network
887s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mautic.ssessments.com/r/75b83926d7fbc31080fd4c66c?ct=YTo2OntzOjY6InNvdXJjZSI7YToyOntpOjA7czo1OiJlbWFpbCI7aToxO2k6MTAzO31zOjU6ImVtYWlsIjtpOjEwMztzOjQ6InN0YXQiO3M6MjI6IjZhNzM4ODU3NDk1ZGYzMDI3NDI3MTIiO3M6OToic2VudF90aW1lIjtpOjE3ODU5NTY0Mzk7czo0OiJsZWFkIjtzOjc6IjEwMDQ5MDUiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjEwMzt9fQ%3D%3D&
Sample260806-eavcnsxyfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304615025143045"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe
2904	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1188	2904	chrome.exe	80
PID 2904 wrote to memory of 1028	2904	chrome.exe	81
PID 2904 wrote to memory of 1028	2904	chrome.exe	81
PID 2904 wrote to memory of 2844	2904	chrome.exe	82
PID 2904 wrote to memory of 3356	2904	chrome.exe	83
PID 2904 wrote to memory of 3356	2904	chrome.exe	83
PID 2904 wrote to memory of 404	2904	chrome.exe	84
PID 2904 wrote to memory of 404	2904	chrome.exe	84
PID 2904 wrote to memory of 2176	2904	chrome.exe	85
PID 2904 wrote to memory of 2176	2904	chrome.exe	85
PID 2904 wrote to memory of 4040	2904	chrome.exe	86
PID 2904 wrote to memory of 4040	2904	chrome.exe	86
PID 2904 wrote to memory of 568	2904	chrome.exe	89
PID 2904 wrote to memory of 568	2904	chrome.exe	89
PID 2904 wrote to memory of 224	2904	chrome.exe	90
PID 2904 wrote to memory of 224	2904	chrome.exe	90
PID 2904 wrote to memory of 464	2904	chrome.exe	91
PID 2904 wrote to memory of 1580	2904	chrome.exe	93
PID 2904 wrote to memory of 1132	2904	chrome.exe	94
PID 2904 wrote to memory of 4232	2904	chrome.exe	95
PID 2904 wrote to memory of 5100	2904	chrome.exe	96
PID 2904 wrote to memory of 4804	2904	chrome.exe	97
PID 2904 wrote to memory of 4804	2904	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mautic.ssessments.com/r/75b83926d7fbc31080fd4c66c?ct=YTo2OntzOjY6InNvdXJjZSI7YToyOntpOjA7czo1OiJlbWFpbCI7aToxO2k6MTAzO31zOjU6ImVtYWlsIjtpOjEwMztzOjQ6InN0YXQiO3M6MjI6IjZhNzM4ODU3NDk1ZGYzMDI3NDI3MTIiO3M6OToic2VudF90aW1lIjtpOjE3ODU5NTY0Mzk7czo0OiJsZWFkIjtzOjc6IjEwMDQ5MDUiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjEwMzt9fQ%3D%3D&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffc21bcc728,0x7ffc21bcc734,0x7ffc21bcc740
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,14884306415462238455,13853638295704171664,262144 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,10685919493004623626,11736912051783256314,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,10413338245806328452,1051359583719903852,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2752 /prefetch:13
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,11829355058222207779,12135291390665501677,2097152 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,8520024097173511912,9293728260072519401,2097152 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,2686562151889334727,16277813906212632997,2097152 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:9
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,6742068205074191569,39427834779682757,2097152 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:9
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4904,i,3913844165528963841,7533571537681159582,2097152 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,14253842231636741976,17304297783085862500,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,3360758087393525475,17215519508098182440,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,10664598567109242817,4166937735847199439,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,9262574536021229029,6492446950678406547,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1064,i,8577191632908999264,8363810249774231172,262144 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,15606406123606196488,6222141615606786258,524288 --field-trial-handle=296,i,7412212844800366096,2962855765458908354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 72b421a78db4ae3d29d1c57d149a52c0e338268b06c0315f084a7a490fcc077b
MD5 dc396cd8efc3f8ec6a53b046689f434c
SHA1 5880fabc21cb01398e9d402c7265a2eaf7e73b39
SHA512 cd77e9460448aab1a5c25e156d272a9c14b4548c4a5b5563d9cac21bca8a34d3c7232e153d8ec0d4ba4d6e6b167810955ca1db6c199a39f23be293481ed2eecd
TLSH
T11DE02BE9C812EC3718F90B5D20A04746F79013A72A418E1F3F3C92188FB1736018586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 d12a67c0234991dc60eac278799d5b6914e294b796b977c9a1f3d8443e60954a
MD5 d5c5efceb6bfb8084196ada985b576d0
SHA1 4d380e9998fc0e94b165334c4c339befacaaeec2
SHA512 96395e8d5bb0617b36a7eaf938395a434fbbb4fb3e30f56e4c34500238f70fd34e94894993b0c61417828bc5058b460d297657792870f2ec236cfc6161604707
TLSH
T15BC04C63EDC00052CF93817913461D741611169F522433F3A6C95F68C45BAE6D80825E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16eb0e3c9ea28c538885c005d84b22f0dad63ab7793b0fccc9bad8c87b43ce1a
MD5 5b14cd58ea89323c48b03197ed408540
SHA1 a493a90290ccbb342dbdf60a9dbb064d3217828b
SHA512 f75d73fcf195a8b981a2f595c2b438c827d00da17ca8ccff853646de3cc7a29c698cb648fbbcb812addfbca13642dc6399ac5f385a1baa6f975e56e889117ccf
TLSH
T1284148B7C7D8897D890196F8A7156E1FCE690E14532C3D5788D8AF0B63E2875D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 38b17bd8bd925adad9fc474c62569089fa445248673d1e7dfa4c9b9cf56f9722
MD5 eb09f9b6dca583a50495eeb8b4bc5036
SHA1 645c09933fb2dda448485e25d493aed99a06cbbe
SHA512 0145b8f241f82a0af4e5a5fc758a48142d09251493bbc61aadc33dfa97d1be9000c4daf09e4af59d44aa1feb290348eed3fc1e1aa87577e6a99ae844962bdabc
TLSH
T17A418BF793B4997E8A1092F4EA156E2FCE690524032C3CA6C9D4AE1B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 026923aaf8b90772ec980e6d2fa31fef355ea3c7d20a61674928d7a62ea6a0a0
MD5 d0e7373fea2eeb9a4155fe0741d96409
SHA1 922b5f41ebf4322de4ef5a307da3e48c68971b6c
SHA512 221e33207dba118a0e91009e027e94198aa1c547cf3eec04f1293f410fab78c4e5b438a027678300cd5ff5a6829908f92597bbb4bcfdd67c535339dad2c91764
TLSH
T156418DF793F4857D8A1196F4EA156E1FCE690524032C3CA689D4AE1B87E2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 25edb64d137e72e2c86bfd26ba04323016aacd3eea42f1dd93dbfcfe1ed510c5
MD5 b0cbdefa92a1049abeec51ce10e56cb2
SHA1 4fb8a30859ed834c3bfbddd6ef494c2ef4c58e0c
SHA512 672e6c62ce6bd0a34278483b3e8d027e2bb2e5051f2b001bee7f63d36d100f7c0d8d2baac627e3c2db1509bc60374c8cc2fa1bcf3e7dd094b1b90fc7499bbd59
TLSH
T1C8417AF793F4997E8A1196F4EA156E1FCE690524132C38A6C9D4AE1B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b4ec46e89294393d68cb9d6f0bd0b6c206d3c8c68fe9fd2bf1adb631664da9b3
MD5 889c38f88a0d40b80b1c8f136d14f849
SHA1 0a295cfeedf38088b8a0a32bcb3add42f2fd9ce9
SHA512 846c39cf3f1696def7edd2b3cfc465f715b85f007cc250f47baee391e20ea1bd5e2c82602ba12f3da00cf246f340c8ed8ab0e20c28d594945d0698c86f544749
TLSH
T175418DF793F4997D8A1196F4EB156E1FCE690524032C7CA688D4AE1B87F2972D10078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 92f62e69673cd9365fca5d8f777d54202967f3a37fc971122fa208d5c3e9470f
MD5 f37c2a113a01b3627bf09e50acbe303d
SHA1 c8f25be5f596418665505f04f135e522f3393872
SHA512 471a0e113b7bcfb8102bdba0dee157771f710c058566c1d69d8bd22a09deb8596f2389bd49ef576230e610bb12a27ef96bef86bd0385121191f5bb16a22109bd
TLSH
T164019E97D7BD741B00BD05BB5E04BC0969B1783102A164F4CFBBD17DA1865BB1B02457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8edaf6ea702d817301bdda66211d061c92fddf57416ffa6440ab1c4801184335
MD5 8a698ee5cba916c12912e1ca12e39cc5
SHA1 7e91e439e4dd04493b554fe454d67d9120c09473
SHA512 d29b392460a28eab81b260ba107744233fb4e06d6bb224a0823d4bac1e569144f0786bb3b69d1634fe7809504ffc92b03f717620b76fa71080ed25e279d7fa18
SSDEEP 192:4RIkd2rro1v2bVF7xy1Cyoev7dpAPRp24I99Hsb+WNn1EG1q2Fg2im5gVyIsnAUp:4RIk7v2bVF7xy1CyoaZUXArwax2m2ihe
TLSH
T17A42C62EAA506D3B5CDBC229F9627763E7F5107225811E84E6FCC92C24E79CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 844ac8e5fde94b949232f1622cc4fdb4b7289c85908cddca2e0d41b2a55688e3
MD5 70ad2b37c07254f3c3b4885d2c78ef2b
SHA1 d4f9c819766099cd080737657627773f4412f084
SHA512 933d37fc91852b316f1d58f2a8b75983e85ac2ecc2458af1b74d4cab3b3cefe4f71b70f0fdc927f8b1577892f11bc8fbe082340e913b11f4096a1ce5996d7ccc
SSDEEP 384:4RIkSRv2bVF7xy1CyoaZkXErwax2L2iKE:tkSRv2bVF7xy1CyouXrwdL2s
TLSH
T19E52D72EA9506D3B5CDBC229F9527B63E7F5107225911E84E6FCC92C24E79CD322341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 04173526ef7b5ab7498395ed697b2db5d0d1be396e55c42f139d32164c00e3e7
MD5 f5ba2a25c10b54193703d80c375f5ea5
SHA1 3aa9a9e4f852c46c950433acf664e082c2528432
SHA512 31a0745054b2b37525b337a41416aa8abad98382a3ca4d2235976a853bd597ec8a55eea3b288c9fb21780fe3daffdf89d8e75d6de7b7f693f7e7d2dc77b9c20e
TLSH
T1B1B01200C8055111C04202F0224218DC72245F15970B170953E07933CC351618054190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589f58.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589f58.TMP
Size 96B
SHA256 bda10a3a07b207f948990123614f382b77c490161cd816dc2f4afbe0aadc7c11
MD5 4adaf3c8132a13949a90b0c7d505d5bb
SHA1 cde605d750d09affca7e2229b6073f159ffbae9b
SHA512 00cfd9c7b598550b4b2e79ffda6c194227716a188376544992b2c05aca810c38405ff0fd68d96a844cae7a4455b54841b52ad9f6cade53eebceb6e2e602de5dd
TLSH
T1CDB02282C203A202C20303B02BE080C83030CF3AC303032382E00AA3CC20B3088280E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f4f047f7511c462e6fd04428d64c6182c3ada38a6db4f5d03d23e4bb5a64749a
MD5 0871d02a4f68a7de9b1ff9e4bcfaf0f5
SHA1 bac50e51555df4944ca0dca3ed8e8765963812ac
SHA512 8d7983ac051f5ebc79eee93833c47b0f84e933e88120a07c604e971c2382046e6c443200fd026ccc025fde19a0d04c012dd7133f3d71cdcbd3aa3b69d911a629
SSDEEP 3072:3tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3km7Rkm1tYpBeh2BAoi
TLSH
T152C312375D75ED3659B9BB1EB08E0A1F2EF149A3C920DE52C8D85A0423EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 326fab6a93947f9c506b215c42b3c20044d4763d802b093e1e0a236de655c101
MD5 a64af29d4c95aded6e7a91a738036a85
SHA1 ed18dd8ee59e6bc1c0fdea63d914dd796f3d2eb5
SHA512 77354c3183e7d95ed603cec3cecc42e9d42149014ab991c50e82050d0b1552749df7c080c690a785cea3d0faacee6d4bbe55a55537fae4d8eea95cd94d1edffe
SSDEEP 3072:utGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:ukm7Rkm1tYpBeh2BAoi
TLSH
T18EC312375D75ED3659B9BB1EB08E0A1F1EF149B3C920DE92C8D85A0423EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e9c419265afe21091f463f973d684a7d519cc09b8f605ee1da5b166e11699708
MD5 6f0844e5c80c1915e554507cf505a898
SHA1 a181f4307fce6ac72f16ba9cdef23e208dcfc1fa
SHA512 c66095ad2bf2b24b7415a0894eed2f71af4085d2488a39fc16127c92782e65b8853a81912af715e6b816fa4165e028b17430fa21f1a8cea623e3e4cb5d33c9fc
SSDEEP 3072:UrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Uym7Rkm1tYpBeh2BAoi
TLSH
T165C312379D74AD375DB9BB1EB08E0E1F1DF109A7D824EE92C8D85A0423E97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6f99b238ca6e3b6c5a074adb13221c618f60330e4e9cab21f681504424739f0f
MD5 3879b82ebf7a6f5e1ca9aa8f20202105
SHA1 4a01edfae868d434f6b7824e27e88a9b23315d1d
SHA512 9cc9acec7d99360adfd31add227830f4ce6880ab63fb8eb9e78264aaa5274131273becc0e4f22fa7486fb928a5c6c9450165c72d83501ab72f50aa8aa9cded6b
SSDEEP 3072:grGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:gym7Rkm1tYpBeh2BAoi
TLSH
T161C312379D74AD375DB9BB1EB08E0E1F1DF109A7D824EE92C8D85A0423E97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 85e9227faa74951c3c2e3b0d285c5e9cce2824800d16e24cc9ec0c0fe2f8304e
MD5 d96cbd52a45622325da214048295041d
SHA1 fd36e2d7274a726385e78c07710a785f95d211bd
SHA512 6aee383aee81fcc9816b001e8815c567f5051064764faebcb4e84306b16cff24a92ae0f7541f6145e32cc65429f57d72f92aa351949a859398e44c763ff669eb
SSDEEP 3072:rGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:ym7Rkm1tYpBeh2BAoi
TLSH
T10CC312375E71E9365979AB0EB48E0B1F2EF14DA6C830DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download