hxxps://www[.]mediafire[.]com/file/hq85wgi95v3nz17/Chara[.]zip/file

Analysis

user interaction
yes
max time kernel
60s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/hq85wgi95v3nz17/Chara.zip/file
Sample260807-kdyr6a1amd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305649984447919"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3504	LogonUI.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4444	1864	chrome.exe	85
PID 1864 wrote to memory of 3888	1864	chrome.exe	86
PID 1864 wrote to memory of 2612	1864	chrome.exe	87
PID 1864 wrote to memory of 2612	1864	chrome.exe	87
PID 1864 wrote to memory of 4748	1864	chrome.exe	88
PID 1864 wrote to memory of 4748	1864	chrome.exe	88
PID 1864 wrote to memory of 4848	1864	chrome.exe	90
PID 1864 wrote to memory of 2076	1864	chrome.exe	91
PID 1864 wrote to memory of 4848	1864	chrome.exe	90
PID 1864 wrote to memory of 2076	1864	chrome.exe	91
PID 1864 wrote to memory of 4700	1864	chrome.exe	92
PID 1864 wrote to memory of 4700	1864	chrome.exe	92
PID 1864 wrote to memory of 4764	1864	chrome.exe	97
PID 1864 wrote to memory of 4560	1864	chrome.exe	107
PID 1864 wrote to memory of 4560	1864	chrome.exe	107
PID 1864 wrote to memory of 5024	1864	chrome.exe	108
PID 1864 wrote to memory of 5024	1864	chrome.exe	108
PID 1864 wrote to memory of 2364	1864	chrome.exe	110
PID 1864 wrote to memory of 4232	1864	chrome.exe	111
PID 1864 wrote to memory of 204	1864	chrome.exe	112
PID 1864 wrote to memory of 4236	1864	chrome.exe	113
PID 1864 wrote to memory of 4236	1864	chrome.exe	113
PID 1864 wrote to memory of 4908	1864	chrome.exe	114
PID 1864 wrote to memory of 4908	1864	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/hq85wgi95v3nz17/Chara.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff929a4c728,0x7ff929a4c734,0x7ff929a4c740
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,80610155094021592,13477424482683397863,524288 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,6205205375442362485,960810666233257617,262144 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,13540928460350583146,13807186781251101894,524288 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,7802712528222976386,4299151948906116023,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,12416724155044377674,12466288771377575441,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,16667252307447625528,9537350061093969387,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,9732818973684294165,33332526798429248,524288 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5540,i,5794282718980271632,17451806758554867907,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5360,i,1130251404107894266,2803527435263929959,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,18204187051604872534,14683978690320774499,524288 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,18030326645716199749,12235619895599454020,524288 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,7664169864253759252,6583083986154925900,524288 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3168,i,11114186831629935540,9075551034608827891,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5880,i,5284294020566056080,13644007001728357662,2097152 --field-trial-handle=2080,i,1282579426985969366,17913166949034469883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2824

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ad855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7a9140f2271d5356fb4786b1ffa0d7571d9fd1a5e69afb5fec3af3e416c4645f
MD5 0888d44f4039385f43f2b18525e96cac
SHA1 f29c7e100525a735c43ed128a59400eece8602c0
SHA512 2689b0f2c30343ce6b651de2a74c4ee174dc7f32fc2c4e3f7b81894ab50d721e5c1b74d4c5d57d2a29ae2d544a8224d9044688c3d7f52b1b2fd02cee3d7c661a
TLSH
T187E02BA9C965EC3B28FD0719A0101786D754239B2B40C94B7A3C900C8FB1A374585D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 c2c64b26b48ad03cf2471f62124dcdfec9988f812affe76e89fad2a46e05cd6f
MD5 442f129878bb1be6bf58fe2deb7917fc
SHA1 c4e119311b4da9dc9e6989dda2c6d94959681cba
SHA512 66a35917a2fbc2beb6a995d5b9cf4d81f820410144a107c17eedec4593e1a8d8d2edea742c25c666487c07fe5279aa4c1aa3d40b6b28c2d3248f4515378be8cb
TLSH
T143F09AD1A0801080DF840F7879EA6FF6F032AC05CC13AF2B83C24EF08412BA40035C5E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 8e1dc3b095c727aeaccd0664df6003d954a3b2a2400f03a15c2afbf50818a023
MD5 a44f29ff075faa420323836bab0df044
SHA1 00011cc04eaf3f5f671120382cdbf37caf837b25
SHA512 c5b69ab1b8e7921f9f56960afdfdf9f3286fbeaa31e05e281a674d31f4b9286703cd37edbb3d95d8d60300499d318b243551fd2bcaa3f209164d47695ab8ceac
TLSH
T1A8C08CC1048020C1DF40027C3CFB28F2F0755D1401131A168BC3DFB0C401BF05108C1D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e8624a33a44b071d2f5e82b92dd97bf2251645c60325b9afb8ffb7f102941cc6
MD5 f7f42700f5aca41918275646bc11a1cd
SHA1 d02be07c471fb901c467edbb33ce17930d62baef
SHA512 005139b235d29193e0b177f5cf436f0ed189c297fb3cdde0296b1bed462b703bc859932db64870022b33f83d847522ea12aebc38bdfac8ce42fd82b1aa7c3de3
SSDEEP 192:DSbCrm6fB1t2aIaEdHYi44yskYmP4WYKuHg3ExjfdoC0GQxJGUyuj8K:DSbCrm6fB1t2aIaEdHYi44yskYmP4WYQ
TLSH
T17C128AF783E5C52E890157F896146E1BCF1C0A29432C3C2689D5EE8BE3E3472E16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 853B
SHA256 2e562ce7b88c89546d314684cfaed8c538dba49b4f3e69a53b257574cc2333d5
MD5 1e8385fed7191ebed058c9fa14a13211
SHA1 3a3ba2f6f960200f2e4e5382823cc03ea58ceee5
SHA512 450764156921e0dd8d2b70707d83507481f44b7e9cf670b48474cf7e92cae839dd0b900d62cdbb47f3749c1903e1707ee6e7ec17c62650c47430bdb8f5d6a9d2
TLSH
T1180148A3E16EB467106D48BB4D44FC0A567AB835038268F4CF7EC16EA0D94E30B23856
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6470a4a5217db3ad250cad60d8cf57c934952cd375599b9b4b7a40a62340bdd9
MD5 5081f35371f9560695ac46ab12bc1165
SHA1 5912d6e691bdafafd2c2bb30451b92561b0bde09
SHA512 8888aa4f3929ab57269e73364c4523b0f0b2da3e705c982d8cea1e19d81364b22ef72a390570ea651c96fa48b503eee22c67f23342ebb26deea25606602f04a6
SSDEEP 192:IR+nILzoG0v70pAPRp2dj9+Hsb+WNnxMPMoMeyVyIsnAUge:IR+niwgUX68wqPBIe
TLSH
T15942C62ABA10697BACDFD229FD617B53D7F6102225911E84E7FCCA1C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e47a5fd0806aec6ad82b6d1fae7b3d325977a2f9c5787adb8e7a8f3dea13ba7a
MD5 3ea327b15a17f1eb3a12a7df5a6b6283
SHA1 2940800aaaefc93ef7c45bd97ef6cb468c98abd5
SHA512 c1365c07313d7e20e8c865a591e2dfd8afb35af476b4faab43442f136b23d49befc47be01afd6bfd8e6a0ef0d790a8bcfa7c94ba5325bad2817c659810bf673b
SSDEEP 192:IR+nILzoGDv70pAPRp2d2n9+Hsb+WNnxMoCv2nUoMeyVyIsnAUgE:IR+ni7gUXZ8wql2ZIE
TLSH
T11C42A52AAA106D7BACDFD225FD617B53E7F2102225911E84E7FCCA1C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f8c8d33434b32b439d4fe00f4e0a9a6d5d297478f48c3b26f802557119c33569
MD5 78ac4df355369b6a0faf1a3cf59e477d
SHA1 9010589f3a17d6d332348a82e5149521f969b4c4
SHA512 16be47d98f2083b89ac2d04387f0fda0c2c8af0fba72e276dc716d80904964642038ec36b30f1a78f0ed592b296b2054f06d230dc17deee75efc57389c105fb3
TLSH
T13BB01241C4435122C40202F42182189872189F109A0A1B0143F0AD668826650C0140A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5903a0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5903a0.TMP
Size 96B
SHA256 00841872c7e515dded220150855ee4f7f627afacaa10e48a01adac9aa367cb58
MD5 9c344749ffeaefc2098650de52caa84c
SHA1 d642e19865b15b5d94c8cafde83b42c0e6c41396
SHA512 593cfefd7790e0e7bfeaebdc5e1576b4f504d5369d895bb53109ae914303b6ed95fc0104fe1ea1b940bb3f80310a68befce1865499eeb3335e283c04140cb419
TLSH
T119B02220C002A23AC0020BB0388088EC3020FF28C2030202A2F08AB3EC222A02030020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b1965e03bb07ea3a14f168eb92597dc21160f53d60ed11a54a67683efbbb5b60
MD5 a97243c6309fab3f2e74360a94fe70ed
SHA1 a93f5b5afdfc3a5600f9c776e4bd297741a7eac6
SHA512 17bc14d1f425a6a22363e68a8c6cd17487b3c8d2582b7239fec3d91227efc00a5d5841860ef87fbb4664d6c957bf8eab79458a568b1519ffcf01dd37d1710493
SSDEEP 1536:bgLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Eqfd7NtZL8cHQRZEQ6Sps3
TLSH
T191C30237ABC21F339D92CF64B9130FDA97B644A99030D301AAAD37FB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 33bca11533105ee2aafbdc143abaf02ef8a29da62d0dba1ceaf89bf686edcf2f
MD5 3fc6906c9914f5a5b40fcf698be0c174
SHA1 ac8e8ce11b46c209f7c77e3ababa6f400cddde9a
SHA512 2fa7c1b4b60d64d2bf8f8dfdc494124e178d6c79f749677fe84c3e0f1fc9098d7661c0b4e6f05528626661dbb46e4b873fa893263d9f63a20d1bfe1c90b2b1ca
SSDEEP 1536:GoQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:3yqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BAC30277ABC21E339ED3CB74B5130FD797B644AA9034D301AAAD37FB688359164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0e229247c3c248855c021bcf1d5d10e368fa9855e267e028f6cb3110dba4be70
MD5 dbec32e027a1543cc0e90f1ec64d6abb
SHA1 aa958d39b34186bcb49899ad832559eed10161ce
SHA512 6c312ede9ada59150bcf983ac613075270182e8d616f01368a175e22b72170c364a8741e186d2576ab5a9018cba881101f1814fedf3979cfb2a4c67145a389bc
SSDEEP 1536:1JVyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:vbqfd7NtZL8cHQRZEQ6Sps3
TLSH
T10EC30277ABC21E339DC3CB74B9130FD7A7B644A99034D301AAAD37EB688359564424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bd7d5f758d818e672d27754b15ba817f163d3b52eb4b975a7cadcbe561c8d0bf
MD5 e6a5fb3f8231db5b2eee45f95913e95a
SHA1 bb642abcedb6e758d4c4861a476dcaaa8235d53a
SHA512 c7cfb72f5cb527adbeb0b60142c58d2cc7a36fcf206aafc3c787f2881795401332782707927cc39c6f9e14c8fd0748129a67afe31f3f321613ea6a782e4be21b
SSDEEP 1536:1oQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:yyqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1F6C30277ABC21E339DC3CB74B5130FD797B644AA9034D301AAAD37AB688359564424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 58df78f25b13e22440e8fd30d0ccf9a39310277d3c041bc2a4312b04ad317933
MD5 d249b279a9852fd654b44cbda47a1c2d
SHA1 545f68cb1c65b224a1c6a523f2c1f7bcced93be5
SHA512 99e171cf4e1f003803dcf964436256926fc6d9e825ca3e4d763b555005d81bb6b315172dba7d99f36de722b7dd0396e551af63b5701ed5312357b6391310f891
SSDEEP 3:MsEllllkEthXllkl2zEkld/K//l:/M/xT02znFKXl
TLSH
T152440444FFC00C15C51434305051C3700770D4510513D7433CD10C535CC55504C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download