83fd2b90a7d269379f6746f00a3ed3cfb40ca0186a1b9e58da6579a897263ea3

Analysis

user interaction
yes
max time kernel
115s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Яндекс Музыка.exe
Size 195.4MB
Sample260808-w5cvjsbr8z
SHA256 83fd2b90a7d269379f6746f00a3ed3cfb40ca0186a1b9e58da6579a897263ea3
MD5 41c0953440536538c7817bd9801dc785
SHA1 adfe5cd18d9f167928b5580035da0e7246ef503e
SHA512 22fb4d6e1780212392d1dfb6db4f8337d99de1aa1b566ab8564537a7e7f40800d18ac5f2f681dde136b18c8ce51163af80db3eb9e0d1d6a279626fbe8c1bc79e
SSDEEP 1572864:xRrxd220OMtMYV/bvBOP6NW9iH0WcEuZwDRhCjoEVU+eJzBVT7WMuP9NWrniig08:O2qTvKGg9L
TLSH
T105A88C13F39A50E9E01DD1B58B479633EAB2B8454328A2DF27540B522F77EE46B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306875950631616"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "7"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4556	LogonUI.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4156	5048	chrome.exe	103
PID 5048 wrote to memory of 1988	5048	chrome.exe	104
PID 5048 wrote to memory of 1380	5048	chrome.exe	105
PID 5048 wrote to memory of 1380	5048	chrome.exe	105
PID 5048 wrote to memory of 3392	5048	chrome.exe	106
PID 5048 wrote to memory of 3392	5048	chrome.exe	106
PID 5048 wrote to memory of 644	5048	chrome.exe	107
PID 5048 wrote to memory of 1848	5048	chrome.exe	108
PID 5048 wrote to memory of 644	5048	chrome.exe	107
PID 5048 wrote to memory of 1848	5048	chrome.exe	108
PID 5048 wrote to memory of 4852	5048	chrome.exe	110
PID 5048 wrote to memory of 4852	5048	chrome.exe	110
PID 5048 wrote to memory of 2864	5048	chrome.exe	112
PID 5048 wrote to memory of 2864	5048	chrome.exe	112
PID 5048 wrote to memory of 3776	5048	chrome.exe	113
PID 4744 wrote to memory of 4092	4744	chrome.exe	123
PID 5048 wrote to memory of 5608	5048	chrome.exe	127
PID 5048 wrote to memory of 5664	5048	chrome.exe	128
PID 5048 wrote to memory of 1224	5048	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\Яндекс Музыка.exe
"C:\Users\Admin\AppData\Local\Temp\Яндекс Музыка.exe"
1⤵
PID:556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeb38fc728,0x7ffeb38fc734,0x7ffeb38fc740
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2012,i,2003197539140959187,10671638460562730052,524288 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,9990296450942978479,17288344394864996989,262144 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2440,i,9618524935349621775,11029389805760798455,524288 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3304,i,16865496515636293602,12576618758935548775,2097152 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,14525461361121431395,7326582024097491353,2097152 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4356,i,8848350732601925811,12180441310437338442,2097152 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4852,i,16431491654520250172,7206352993470198975,2097152 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5596,i,14761002365021989992,13651462838380097497,524288 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5832,i,11133266138373927039,2496024742767397222,524288 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5864,i,2057085064368979088,2950696149211533584,524288 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5876,i,18088025332212401932,10142657935200424392,524288 --field-trial-handle=2096,i,14554220741202087045,3828187081130392341,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:5188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeb38fc728,0x7ffeb38fc734,0x7ffeb38fc740
  2⤵
  PID:4092

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa38ce855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 5a8e6ff32f6bb6427cc0998fb314ff95032429cb54b3783865bbb1b06bf3a624
MD5 265e8a637128e13bedd26cb6ea29215a
SHA1 506e234cbc82bb4f90f406f0de318dd61285d40f
SHA512 bd40a74648a5cf88b68bad0eb66885aaf33cc08534b9d26f2fe7ee59d19dd0e4778b4ea0a1c80b6e6a5af14c3c6d0bdde483ecce38be9f60002d94f04ba83a6f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d70b3dd57053a47032e424ccee4eb05bc3109426d2e88e46ad438615012a4fd5
MD5 c656df5c28333cd895b863a6b0534aff
SHA1 20867205bd4fe54153a1d365027bc28acfb22b98
SHA512 371cb49033ffd8d4d4e54631fa0d7de71731b61c4f4007fad973ab559e2170833a7fd6519cdad90bfd1e218fd33a6c13b258b7ce45cec15fede5c02c86d744c1
TLSH
T1B0E022AEC9A2EC3719FD171CF194474AEA54136B3A40858B3E3C89188FB433A468689C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 888a220b6fd1c704edc1bcf4df1b8fa9c96ba34bf134844d490b80bcf287cd39
MD5 92eadf08ec0083368863821c196c355f
SHA1 4d5f1d885590f590398001da75e892b937fa97da
SHA512 2d104e948e3dcd5d5cc2856e000bae6ac33b5ca7fd5835f2c1bae840df02d0822fd9dad6f470a5d1e683e4afecfac5b0dce33a78f77510452e4622a61376c9ca
SSDEEP 192:tRd5rt75mnv71hpAPRp2g92Hsb+WNnQPeyR2IzI+VyIsnAUgraJ:tRd5xcvBhUXDQwwe62IM2e
TLSH
T19042D82EA910B97B6CDBD22AFD527B53D7F1102121E52E84D7FC852C19EB5CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3dc475322b2acc27146fe18fdfc0b540559993f55d1a7034bfed99ea3f793223
MD5 f7f23fafa141d5e72981cf2a4cf05d22
SHA1 eef2933876d1edf4e3166da22e65a9118ec35ded
SHA512 fbe77c0976010e3a4c38b9ff3ff74809c2c5ee29f2e0f340379dd52a42048fe18b297457a557ddca460354f8666eee2c13ce312168d6fca6938f0722c1218953
SSDEEP 192:ORe5rt75mnv71hpAPRp2g92Hsb+WNnv80dR2Izr+VyIsnAUgtaJ:ORe5xcvBhUXDQwE0j2IP28
TLSH
T1CA42D86EA910B97B6CDBC32AFD617B53D7F5102121E52E84D6FC852C19EB5CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a26fa9967e828d4c8108ed65679eb8f6759143a448bc28487ad01bdf094ca434
MD5 d73beb80176592945b6411fc9de1f3b5
SHA1 02a7c4993099cd2bcf16cf00fb90847d4d7d1393
SHA512 4d899259baabc935fe03fcdb9b34538abed4a469231cf3c507a02e9da19f4faa5b3b27ea284de5e96f6228cbdb371ee643563b88807027509ab92adff9c7708d
SSDEEP 192:tRM5rt75mnv71hpAPRp2g92Hsb+WNnWVniR2Izr+VyIsnAUgtaJ:tRM5xcvBhUXDQwAnK2IP28
TLSH
T14A42E82EA910B97B6CDBC22AFD527B53D7F5102521E52E84D7FC852C19EB5CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bff0916db30104763c4071ad93784f6eeb38cb0b3f27a1197752096c99d8f1ce
MD5 fff4fed098e916dfff1a5f8f952f1f13
SHA1 189d48588b51a7079d6ef647859f0dc8f81c3481
SHA512 c1456a7a138aca89abd8d0b7674fbf32d65f51726d1ecfdfc0515c852356f7ea54d797f6616338704672c44c0ef52e983533a594d9619f6d88116037a73e6c43
TLSH
T15FB0126080015543C04202B02152548871245F10960E270583E4E932EC251718415051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59939b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59939b.TMP
Size 96B
SHA256 d418164404fde8097bbeaf250142c827df0a8fc948fe87060f6876bd6279d8e1
MD5 043dbfdbe4c4500ddc5c03e71c0d6c3d
SHA1 7ae699a433637e9ab0d88e785121c47679fb4923
SHA512 d8c6a85a4fbf0f350978dc069b716f0d93073f6c668e7ebc53e3a2f5d03fe3537fdb1950b98ff8f4cd1dd851cd8164f0b42e006598453c1856bfaab03e935cc9
TLSH
T158B0228AC2032202C02203F0B8808BE83020CF20EA030302E2E00B23EC222328020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 af5ed75795179e6b267fe2f5cf77a97f1885618957b263b41083672b4acfb6dd
MD5 d3eb8356a280aaadcbaadd35a07a5ff5
SHA1 7057dd529c61c9887a5e096ce88bb6bb7ead0caa
SHA512 3db02b53008170d7b438c513c18cb6d7fc13aa7e0be5143ad991326789e26efc770537e942ac2c97620ccb3f0f0519626168c9fed1f3cefa0da37a2f46ec09be
SSDEEP 6144:ZhxNPRW2PYddqmY7U52FHm7Rkm1tYpBeh2BAoL:PXPRW4Kq97UA09oBGcAoL
TLSH
T1033423122DB5BE394C5DFE1D308F2D2E2EF28ED494A4AFC2C8D49F08279E9841955D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e71e873b0eb8a8487ac41dd2aaca58af2886b243363afd9dd97efb390a64216b
MD5 e827a5a5f49c1e041335988a66402f8c
SHA1 debe35e9483f9375ec796d3f8c48f26fb52457b2
SHA512 01a4056fe41d619ebe3f696593c865cec551d924c3d18facc0b2dd6b9f5d02328367a7f1a3e4575dd29336ec9eed0b9efc455d9757041c7c6d8dd25bf66d7689
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Jm7Rkm1tYpBeh2BAo3
TLSH
T165C312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D86A0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c69b536c95079ba0b9577af9772d35d413492d84f9c749081b2e36eb128a6a95
MD5 288847943ebdf29c5238e8345b7ccb70
SHA1 869134bca11ec834595a88a30f88632d7bfa2274
SHA512 bd3aa8408e516ce55edafb47254eb010ec979714d8e6e0bb43f16f815df0116c3d9377cdc7c2d9b6b4c145c1e6112d764b09d5ac3bd2a5e0d8512c272967d631
SSDEEP 6144:ShxNPRW2PYddqmY7U52FHm7Rkm1tYpBeh2BAoL:WXPRW4Kq97UA09oBGcAoL
TLSH
T1FC3423122DB5BE394C5DFE1D308F2D2E1EF28ED494A4AFC2C8D49F08279E9841955D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8c095d58cc272fe36624ba9f5a3d0feec403f757bd38764f832d86de75a8d32a
MD5 f0c3f3bc1881e569a571a0d07dddba13
SHA1 2b8b9748ff326844a563e0cea180cc36b163586f
SHA512 9f665f76dc3f0d0adb3c42a3c4fbc0799da615f98fefd2c72f95ce738fe077efedc6002c992e07359e5cb5ec2c72f7002897c14a76412dffbed6401b4671a742
SSDEEP 6144:mhxNPRW2PYddqmY7U52FHm7Rkm1tYpBeh2BAoL:SXPRW4Kq97UA09oBGcAoL
TLSH
T1803423122DB5BE394C5DFE1D308F2D2E1EF28EE494A4AFC2C8D49F08279E9841956D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download