0f22f841b6f1698590ca366a66ce6d32e88e5193033de47f710073af6f614088

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
all.js
Size 29KB
Sample260808-ppqcdafk9y
SHA256 0f22f841b6f1698590ca366a66ce6d32e88e5193033de47f710073af6f614088
MD5 75c814ef300fe22f5b429ec99e0f0e53
SHA1 5c7948f1d82588fe876cb667374894b182c74d10
SHA512 19b66a39a1dcc7548863f5a859f08a8dd0e1f0c62e5891f56096bf62b534dbb0f4488462390366269d636bea10674f57b7c20a672d4bbf03729f84c970f9b90d
SSDEEP 384:lM/46fmWwpQZzeTnjmFvzatMQtQSmi4oEST6QkzFiqiFNxTeuxS:lgTR5Cj1KsPhEQ6Qkz0TFXeoS
TLSH
T1AAD2C70950B242736B9F70696D7F6B0C3A25800BEB49CD187E6E93880F44D7296F27DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306658676748789"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{1E59352C-27BF-4747-9BCB-C46F7929C364}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
2164	chrome.exe
2164	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1748	3652	chrome.exe	89
PID 3652 wrote to memory of 3480	3652	chrome.exe	90
PID 3652 wrote to memory of 2316	3652	chrome.exe	91
PID 3652 wrote to memory of 2316	3652	chrome.exe	91
PID 3652 wrote to memory of 2892	3652	chrome.exe	92
PID 3652 wrote to memory of 2892	3652	chrome.exe	92
PID 3652 wrote to memory of 1872	3652	chrome.exe	93
PID 3652 wrote to memory of 1628	3652	chrome.exe	94
PID 3652 wrote to memory of 1872	3652	chrome.exe	93
PID 3652 wrote to memory of 1628	3652	chrome.exe	94
PID 3652 wrote to memory of 4184	3652	chrome.exe	96
PID 3652 wrote to memory of 4184	3652	chrome.exe	96
PID 3652 wrote to memory of 1752	3652	chrome.exe	97
PID 3652 wrote to memory of 1808	3652	chrome.exe	100
PID 3652 wrote to memory of 1808	3652	chrome.exe	100
PID 3652 wrote to memory of 2944	3652	chrome.exe	122
PID 3652 wrote to memory of 3552	3652	chrome.exe	123
PID 3652 wrote to memory of 4680	3652	chrome.exe	124
PID 3652 wrote to memory of 2056	3652	chrome.exe	126
PID 3652 wrote to memory of 2056	3652	chrome.exe	126
PID 3652 wrote to memory of 3360	3652	chrome.exe	127
PID 3652 wrote to memory of 3360	3652	chrome.exe	127
PID 3652 wrote to memory of 3632	3652	chrome.exe	129
PID 3652 wrote to memory of 1772	3652	chrome.exe	128
PID 3652 wrote to memory of 1772	3652	chrome.exe	128
PID 3652 wrote to memory of 2164	3652	chrome.exe	130

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\all.js
1⤵
PID:1852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2082c728,0x7ffb2082c734,0x7ffb2082c740
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,8042529835064222926,16363495760152127012,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,16009664875205887410,15198690698310119210,262144 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,6513507002550969112,5901251149856399508,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,5627822748927111147,15573779102169704866,2097152 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,17045504216245350513,969518673389972900,2097152 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,3462138379317254137,6744409470933509478,2097152 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,12218244755740526720,15837518468973131036,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5820,i,1182745945265841063,2394464511273392521,2097152 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,12042443913753014352,8536258398565987237,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,73709890212739779,16797766373686540952,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,17701643761149158603,2404111544834958277,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6128,i,9968966969136095703,13445208148649579295,2097152 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3244,i,6756782450295970159,12800813856485299097,2097152 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3024,i,17055281325358102538,3873989396454407482,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,6788377614911395595,14138955357239346184,524288 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1216,i,10491515157423287108,14513068431049325762,262144 --field-trial-handle=2148,i,12322078705876085983,11111813370390455274,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3be394004b796d871a189bff1e967124e1fc39c365a1b2061ae00ad1e84c9cd4
MD5 c8169572baeb7f8471c1d24f61f8a1ff
SHA1 b02730d5f024d074aeb09a6eea2918d9e95116a5
SHA512 e38e553b8702182ba437f11c33d924623409727c02b351a0e84875334ba0a07c2dd7f9ec2d80e9849f04296eed12a1ad14f540f48a709b3e6cbb825b2b65cf6c
TLSH
T11CE02BBADA32AC2B29F9576C90540746E79013573B80894F3A3CC109CFF463E618585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 9973086d9de36029d7d342cf12ce0bb72b68429598eae24d8dfb69c6297f1542
MD5 64a22a0fefa610745439bdd9e64913c8
SHA1 cdf44e06957e29ead68e199576da8edaf1b2d091
SHA512 1bad986db4e08af10993cc12e89d60790df5fea30e5d4917c21095be30b334ef98c104c5dbc7011d23bfb2ba6d863a12dcb6ab461a8cdb5447163cee0f914bfd
TLSH
T14801DC4E2ED8413CCF655732E9EF087D33512AEA3DC236985B50FC7061A65B202F5298
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e37b4c753c41d77b7bae7c2af0c20b14e14899023a024d0013cb21feb14c69fd
MD5 f4cd7da80bd4704a41dbe2647eefa779
SHA1 7c80630c77ee36e6b54677ebf00c88acb7334b23
SHA512 39b7944e7b7e284eba3e76522470fcee77575a1a3542cd14324b4de455d4d44a9d4465b87a60408d5d61ec7848159bbf12dab2e7078dc58b2360a587c17a43d0
TLSH
T18A519CF7D7D8C57DC91192E4AB156E1FCD3D0A28021C3C62C9D4AE5B83E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e154edf1ca69b280e41cea88d2e2671b29f1e26fc81748a8fdda080cd6add31b
MD5 f7647abbe096a2ba6a9933e0d1e24a02
SHA1 e53801c6df702335abac65f0660bf3abd4d434ac
SHA512 69cd9254b0ac46c7cc45410b99c908b1f342e71390b437cb9cc9d4a73f57b4cc3da4a8f4b41fa2ad158e3217b53bae376abb4c1b296c8a0c2bc2ea0e991b3223
SSDEEP 192:xRscBzHxcg0v78IGPRpoZv99DHsb+WNUYHlBjmQ2d0QAigVyIsnAUgraJ:xRsmzH6d4bXY5w7f2jSe
TLSH
T10852C82AB9106D7BACE7D229FD627B67D3F2102261D51E94EAFC892C14E75CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 92c5c16d9bbb7152770242119b090d5c0270962f4efd14a12810ba52b2a92fc2
MD5 f473e4ce065d43dfaa7e5aedeca20486
SHA1 03dff9eeda21a898f1dd800afa880b21ea43cea2
SHA512 3ab33f59611a85b80ea6fbead2b400de554db6c5f1fd556b6946777bb5faf3b5b3eca2c8ad592cb09c9d313847437d4a989031faa5b386a45f27ac42cc2294e0
SSDEEP 192:xRscBzHx6R6Rv78IGPRpoZv99DHsb+WNUYHlBjmQ2d0QAigVyIsnAUgraJ:xRsmzHI24bXY5w7f2jSe
TLSH
T18352B82AB9106D7BACE7D229FD667B67D3F2102261D51E94EAFC892C14E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 684521c59181800d376b60123193ecf3588d13a6d7e0a77f0eb111cba8c98e10
MD5 f6f4f77eb960b5106b7fad86e8e0d17f
SHA1 7d01fd100241da3d5799d1240dbb15a2053fc547
SHA512 b5321cc4343c5dfdd05883a27b5f90b18c07d2e6ab7c33e746ee736723b8ff0c380c8649d7165a6fd7dbd152bd1b4e19db9335c26af7ca7c32cf744900360f83
SSDEEP 192:rRMHxiev78hAPRp209DHsb+WNnVj0tQAihVyIsnAUgtaJ:rRMHUa48XD5wJ02Z8
TLSH
T1FC42B62DAA10793BACDBD22AFD667753D7F2102161952E94EAFC892C14E75CC322710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 285c487f9acb62b629b1bdbaecc6f6696de443b7ba6a11e266fa09d3d6d17075
MD5 85bd965c9b6d1fcd21e9947a1e5b1e7c
SHA1 1246044b3edbf6b3230cdce7a12ca741296399f4
SHA512 7cb87aac445a34e2a649f11ddeb018ef09fe0268911fba42bd30f7def48e142c27e68a88340173850c35f07c422d698e9f1499b2359740253d0a9f232f37196c
SSDEEP 192:xRscBzHxjg0v7xIGPRpoZCv9DHsb+WNUYHlBimGZWU0QAigVyIsnAUgraJ:xRsmzHNdFbXd5w7wvZWURSe
TLSH
T1FF52D82AB9106D7BACE7D22AFD627B57D7F2102261D51E94EAFC892C14E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a5497fbba7c3f26157c517b512e5e8df1252cff2d1c59cebf2412db3ae089a1b
MD5 5f9ab6908313c592a87c12c10f6b2414
SHA1 b13c21c6d00f699013201264a78ff11325ca38a2
SHA512 0cd223b4015e28eb88bba266cc0126a2c741618f981712181c7953ce39cfcf6430386bf4e5e68ffcf0a58219e762b22d88aeca294d024f703770067d249a37e7
SSDEEP 192:xRscBzHx6Rev78IAPRp2Zv99DHsb+WNUYHlBjmQ2dEQAiaVyIsnAUgraJ:xRsmzHIa4JX+5w7f2rYe
TLSH
T10152B62EB910697BACE7D22AFD627767D3F2102261D51E94EAFC892C14E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4973ee7e5f671db4f8866917df11c90c7ca22cfca0c1cda7e421984d268cb26d
MD5 d3ae2337866ca06e16b479c8874b7cf2
SHA1 68d4290e7a061d06baf9d48b3bf817a1f96d1a6c
SHA512 58806a3881686998db3a65600f82c5f0ed82ae622c9aa2b0c239ace369ad5bc59d728a1890092fd5355f57ccc5577e82775e90bda79878b78125a0107a42ef1f
TLSH
T1CBA0029506809025D549067465D169547321D850018D176141929044C9786D08131F45
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 27b32a6b661d83a91167f735c53fa3696bf05bc42b5c8d9d77639c79cf6e6ec5
MD5 d81f7d2e3b36299c60396cf9cdb96687
SHA1 a34bbbe73efdbeae8994f8ca31678ccdbb3db51d
SHA512 4796c84e52d340046fe210a068444c7cef4f24726f549a38416a885c39c57e04cd052e59a2b8064a645c9fb9357800caf460c823aec9ce31e1133679aeb4e28c
SSDEEP 6144:Y21MxPTGrOWsZkCkaeonfNdWFDKiAIMm7Rkm1tYpBeh2BAom:Y6mrGrOWsJkaeWfjWJ/9oBGcAom
TLSH
T1C734133BFE25997309F2FA1EA85F241E1CE28FE3C11CD693D4D47804529FAC41A4AE58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 da0595584df576f39f4b7e1d1e170ccc784ad5756fda62c6c3e48166ab195e50
MD5 ca0114ba7968f9df154744b012eb3472
SHA1 0eee5d4196e8788101cc4aabbddfe7bd7652a2e8
SHA512 957ccf068df7a22ca9f5efa24f2fbf0d00b4961afc5e3ec08335181fd502e1cf9e0a7c7d36a04c353c644fd5a1d8041373b788dfad92dbaed26689cbbd1b5e13
SSDEEP 3072:UdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:U0m7Rkm1tYpBeh2BAoO
TLSH
T13EC3123B5D65E9375D78A70EB48E0B1E1EF24DA6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 1df68f007080be4a3e1816b2226da602aec86ec24054c4a0326d6fe8468a3035
MD5 5efac12a69b0b495a1cf45b595d2e3e8
SHA1 1e4e8f86718a93d409d4809b260a4a5700b573c0
SHA512 4bd26a24b81faaa65c3429810e2558c4dccd54e1d2a9e2b3600595e20e194fd60c4ceb9b55451de1ba62c769565abc168a7954e20c2e0a1f658af70f7810eb66
SSDEEP 6144:3I1xPTGrOWsZkCkaeonfNdWFDKiAIMm7Rkm1tYpBeh2BAom:3IjrGrOWsJkaeWfjWJ/9oBGcAom
TLSH
T19134231BFF35A97305F2FA1FB85F181E1DE28FE28118D7A3C5D07904529AAC4164EE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f3fec7a86f7b08d3559a6b8c1e210d985a8bd903155a7930dca03c7e2a76aacc
MD5 5a9ad48931079afc53ed8c37a875e054
SHA1 7e981ec0d43cee09674a7b567e6f949a5a4fb902
SHA512 6ee853df3c41781e5644a60fa894285c63fdd24b44794f1c6eeea9258a4a02203f72b494518da76bd3111036143f7641a88877a415a99a5238aebceb9e870b38
SSDEEP 6144:Y61xPTGrOWsZkCkaeonfNdWFDKiAIMm7Rkm1tYpBeh2BAom:Y6jrGrOWsJkaeWfjWJ/9oBGcAom
TLSH
T1A434231BFF35A97305F2FA1EB85F181E1CE28FD28118D7A3C5D07908529AAC5164EE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download