hxxps://nightcord[.]st/

Analysis

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nightcord.st/
Sample260815-2j57vsvcng

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313071027848369"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
5696	chrome.exe
5696	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 5932	540	chrome.exe	88
PID 540 wrote to memory of 5020	540	chrome.exe	90
PID 540 wrote to memory of 5020	540	chrome.exe	90
PID 540 wrote to memory of 1864	540	chrome.exe	91
PID 540 wrote to memory of 5600	540	chrome.exe	92
PID 540 wrote to memory of 5600	540	chrome.exe	92
PID 540 wrote to memory of 3428	540	chrome.exe	94
PID 540 wrote to memory of 3428	540	chrome.exe	94
PID 540 wrote to memory of 3376	540	chrome.exe	95
PID 540 wrote to memory of 3376	540	chrome.exe	95
PID 540 wrote to memory of 5908	540	chrome.exe	96
PID 540 wrote to memory of 6088	540	chrome.exe	98
PID 540 wrote to memory of 1848	540	chrome.exe	99
PID 540 wrote to memory of 6088	540	chrome.exe	98
PID 540 wrote to memory of 1848	540	chrome.exe	99
PID 540 wrote to memory of 2084	540	chrome.exe	102
PID 540 wrote to memory of 2084	540	chrome.exe	102
PID 540 wrote to memory of 1324	540	chrome.exe	103
PID 540 wrote to memory of 1324	540	chrome.exe	103
PID 540 wrote to memory of 4724	540	chrome.exe	104
PID 540 wrote to memory of 4724	540	chrome.exe	104
PID 540 wrote to memory of 4788	540	chrome.exe	105
PID 540 wrote to memory of 4788	540	chrome.exe	105
PID 540 wrote to memory of 1084	540	chrome.exe	106
PID 540 wrote to memory of 1084	540	chrome.exe	106
PID 540 wrote to memory of 2136	540	chrome.exe	107
PID 540 wrote to memory of 2136	540	chrome.exe	107
PID 540 wrote to memory of 3876	540	chrome.exe	109
PID 540 wrote to memory of 2004	540	chrome.exe	110
PID 540 wrote to memory of 2984	540	chrome.exe	111
PID 540 wrote to memory of 5696	540	chrome.exe	112
PID 540 wrote to memory of 3380	540	chrome.exe	113
PID 540 wrote to memory of 3380	540	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nightcord.st/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdcdabc728,0x7ffdcdabc734,0x7ffdcdabc740
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,12265927976104806736,16208664782582248650,262144 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,10510772207644261409,9649390462695331345,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,4563555014269635263,13594313158071635306,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,6755251469852364150,13547070389546957460,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,4517605199028909774,12073817627774061976,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,15325284058446909645,10452519908965009132,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5664,i,3362615378853530777,16430941210276832087,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5676,i,13112243386586521687,7242860003026354930,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,4165308174232441431,16018852121443425277,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4844,i,10376943568069096761,1139947942725181101,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,17795358341366940104,2002489433974797918,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4864,i,10417713641983235525,17154849420711601317,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,13316735912661306945,6878838198336113242,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5836,i,14305713744682876119,731055711425173575,2097152 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,1983529307887489731,14520908300613301765,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,674882444970635925,8151883523281178660,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,5377948438453249520,14110375265007062047,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5152,i,11258916328356269705,8355237944933247896,262144 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,845068095313068312,2292823881179636818,524288 --field-trial-handle=1900,i,4676573183418321656,15745552948972935243,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:3380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5500

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 dca150407a4b7fd0431d56059c786ac63ec426c887f2d9b154521538366a93e3
MD5 c44ef701814c3af24a552258273d8491
SHA1 8f41eafb2cf209b088908f2047a4b1e8711cd39f
SHA512 a4491c643dc8da4bcfbe23d4e544324df5338c27589d3749d4a524fd7425cb87d9f138fe71d1ac33a931ccc81489b7f5d60a56918a42b0afde6898eeb9cbac96
TLSH
T166D0A714191120C6DB4805B754E4154EF170067C1B431D31BFA0BE3BCC723460DD938C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d4febe8b0b3572a46669827aaca95e23a1ebc9c44792be625c9832a9b64be027
MD5 d04741a766ea306b6729e18cf389c48d
SHA1 aafb794c9814123e8d222744d1421a0e71774312
SHA512 3aab79f47ceb064eb14adb4caf771fee8c7f2563c2ea7468e6ad5dbf4bdc2a61b5e40637193821a5a13bf68aa71b0da8449506f8fd7d8feb3b23c0eb49038449
TLSH
T1A5715CF797E4862E8D1152F0E7246F1ECE5E0954432C382AC8D4AF1BA7D59B1E10168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f590c49e30f9534a7b0843ed8adac3f721da627e7a119a6f07b9114353028177
MD5 179f5fd63b5b83b23b962a7056b997e9
SHA1 9785e0d15b70a2d355ad2ac5ebeb335767403b07
SHA512 0952678617a5ab962ae7ed1c44472cf7d41c737935f87d35661cbb50a66d55db38c0e56e290ddb780ddafdaae63108f320a2f80275de92d269caeaf044b5cae9
TLSH
T190714CF797E4862E8D1162F0E7246F1ECE5E0964432C383AC8D4AF1BA7D69B1E10164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 902b57eab0a64b6b0140483956f78855126f817ff1dc5b5022729e2fd51e4f50
MD5 5f2323e28bba64bd956c8460a9c7ac74
SHA1 bbe1d218f3b64bc61c04428bb0bceaae9102a07d
SHA512 54ef9885e3d7aa5d3804ca51a6c099e459d8419969e8178aa17d500291784827782a77cddac050019ced39b3aed62850cbd791ffd5dc47ec1e1605ac3e5d922f
TLSH
T1DA816EF7D7E4862E8D1151F0E7246F1ECE1E0964432C382BC9D4AF1BA7D55B1E10164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2e60aa723e82f41ce9abecc2f6aa43cd1556e036a215c03ed4974ade5edb2a5f
MD5 289dc7dd9055bd811175afb0d98bbc17
SHA1 5859a3de720f9309a729c47ddba0309cd975cbdc
SHA512 137c62b7354583bf12e8dcff7af7e4f7c13b9c88d0bac737054a79aa63c06027f22f1ecb4fad8679dbf1629605066484b63637488510b1e8e094736a1781047e
TLSH
T1C15169F797E4862E891152F0E7256F1ECE5E0954432C3866C8D4AF1BA7E29B1E10068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b6da91858e149fe92cf51eac989a0f744790aac6c5a4b75d10c4ef5b6873bd89
MD5 77bcb8121372691ee4abb30dfe32986c
SHA1 634890bdce0b8deae1a00b2280947b90a93a8a2d
SHA512 b2077c0354992d644bfcd788090e8066aa11be28dc37729ef59b5f42d537b33f51a323d7f2e714a7def5abe87450799416b2c399c46dd9d2ce053bda98742bd0
TLSH
T1D6616BF797E4862E8D1152F0EB256F1ECE1E0954432C3827C8D46F1BA7E69B1E10068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 47792efbdef7697c30b3d2e553d63a6d3759965165827ff10e63be3f12dbb5f2
MD5 89ffc871ee75e5a00d79de70defb91de
SHA1 f9cfdc3def7c6caf5bb943ba701d2bd03e2e9402
SHA512 2269c00ce251f617554ea181e2b86fbb7ce58df54a67b3c9db2c4781303ccbedfecde37d2f98f21636147bad24c1bd983c6fa4d07aa9679fb81e744439bf4aca
TLSH
T134F0C92B8AADB0A71078857F1F017809E8B6A8301941A8F8CE6982BCF0C14FB2B11003
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 87ffe9a8c464336b1b06e896767de0f0cccdbefc4094e40d4f24df6df41b9e95
MD5 71dec26f101f1dcc21e3e07e9a511b8e
SHA1 07475095f3c0e89679da495bee7eb61c1a223e94
SHA512 71994a154b91b920159eb39c67770601531732652407c0b6f91290a4c470d1a9cda7ef0c8a4735ac215b88052c4f2bb12380fcb74dc6c13b139903375feffc0d
SSDEEP 192:5RQ/7+gv7+qvAPRp23z9pHsb+WNnO6dPF2jR0qB7Y3MVyIsnAUgR:5RQ/a8V6XaTwLL2jKe03oR
TLSH
T1A532C72FB9146A3B6DDBD229F9267753E7F1102125902E88E7FC992C24E3ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 97d405a417771bcab21417e0baa49773f72acdce3397815b282534f7c440e3ca
MD5 a21158f2cab215ad158915e33d85a6a8
SHA1 e11fcef9b97928d9ecb2ff099385665c615e1c25
SHA512 8483da0642b75d06ebbf226fbbe4a74cc7809b66f003c9b97a4d401d18968fd33d9923f678d42ff867e4c7306525bbca67f35946b06c496c4243fa59c32e9e35
SSDEEP 192:5RQ/7+Kv7+qvyPRp03z9pHsb+WNnO6doOeN0qB7Y+MVyIsnAUgE:5RQ/aGVMX0TwLXeGe0+oE
TLSH
T1EB42C72FB9156A3B6DDBE219F9667B53E7F1102121A02F84E7FC992C14E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5542084-b250-474f-b4ce-18f1540f4f90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5542084-b250-474f-b4ce-18f1540f4f90.tmp
Size 12KB
SHA256 42c209a2d75735d9e77112ba28f02b47fa8ffe9bde667832c607f060b607ee15
MD5 da62191235c4a7c5fde312e61d09df79
SHA1 bd5b523a7279487d1030ef3c7d75e46046f75ab7
SHA512 a1664cb276f29930121a1a998af46bfc9001d68e3b7e617fcb97ea61391721074e96e42aa21f863ac9e94659ce6f39642d26615ed65ef9d7a635aeb82ed33bb7
SSDEEP 192:5RQ/7+hv7+qvyPRp03z9pHsb+WNnO6doOeN0qB7Y+MVyIsnAUgE:5RQ/axVMX0TwLXeGe0+oE
TLSH
T1C142C72FB9116A3B6DDBE219F9667B53E7F1102121A02E84E7FC992C14E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a9fd6015d81ea50efcee27121b970550f384a24a36879dfb3c79069da34ac42e
MD5 de1dedd53e1accca983e1131f19c608b
SHA1 047870aa9bf03d615684afbf8069307649433e05
SHA512 c0d4330d3f9fb51ead23edffd4735b31a3dc9c9925a46ba0f0314dbd48d9e3809cce15c2b94af5f79a13b6f131529d150214a9edfbe6f0238bd87147e0819b18
SSDEEP 96:9bJ0d+Ar2aetJRxW2rgj0+f+U+/EOeziSl8h4otop5a+3DAB6GGyvTNcxnQf99ym:9t0Nr7OJRPrL9/EiiU2aKk6IcqfDyNzs
TLSH
T1D7C10A71946EACE74DF3A445B1032E47CDA8716B2929BE54EEED2E0C00974DC1382533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 12b1a1686527201c7764e3ba7267b6ae175682c0615bf387e6f698be5b26ed07
MD5 3473b00ea4142afd33bec3f18ebd87ff
SHA1 6cdbe6fc9a13827101099c779238525b68cb7a0f
SHA512 d388c7e533791d1eba4af7a80579be2e12eb58c3bbeb87dd403054ea1dca37f52b838695a9948a2f16905c86037a9b3ff3e597b84437d683383c499226f55c23
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5a+VDAB6JGyvTNm6zjN+PEhiv4a:mC0Nr7OJRPrL9/EtDUDaok9ImgjN+shM
TLSH
T152A11932647E9CB759B38545F5563B07CFA4716B5A21BF4499DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fed113eb67272f89387de3adc3bcb888dbc0c1a6280df8818ef20d4bd9f3186c
MD5 b93264db90a61671a12816c137ad5113
SHA1 9c3c8c91a807b46770caa51c15ace1007bed56e3
SHA512 9b568b177edc113b2a99c03e8483e99b63a34ff3250a96f4368bf006bd825030a2c777ec49e5237c42ff4c553b58a558cf649ff0edd3748a71bb2efd6dd9b416
SSDEEP 96:tC0d+Ar2aetJRxW2rgj0+f+U+/EOeziSl8h4otop5a+3DAB6GGyvTNchCzb3PfLq:tC0Nr7OJRPrL9/EiiU2aKk6IcMnPfiyQ
TLSH
T1F5C129B1687DACB359F3E456F1432707CEA4716B5960AF64DAED2A0C00E30EC1386A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4921b85d3b94bc4ac76456e569b36bef03657ea6f4e0eec87896073864c8338e
MD5 6ab5a0a685ccff4bc8f6ad11f0180a98
SHA1 f170a6c3c32ffe73f819492183af7efb347767b0
SHA512 e1c69ef151a513ffad67450a8d1d4e0854a2d9819e1f01bf04ad9f09fabe264267676e5c5a2b4ac5daf4aa221ef08b56e5cdb77d71912fa204be4b5d148b4672
SSDEEP 96:9C0d+Ar2aetJRxW2rgj0+f+U+/EOeziSl8h4otop5a+3DAB6GGyvTNchCzb3oQfZ:9C0Nr7OJRPrL9/EiiU2aKk6IcMntfRyQ
TLSH
T119C129B1686DECB359F39556F1032647CEA4717B5960AF54DEED2A0C00D70EC1386937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c3303dc9eefac493151959f028c289f10c9cbd237c9d58f01ac4a0f6ea64a64b
MD5 7a8c5e85fd9b8a824b8541f600f2b384
SHA1 e4878be6e8f5517e27087b3896238a88c33fb83b
SHA512 81eb9b4a02a717718bbf4de030b4b8158e9833c955c4cbf9db32a1be95ea36ff3aeb11f33e1161e8876501a5a993b828ee659798407d77286dc83a2013b354ba
SSDEEP 96:9bJod+Ar2aetJRxW2rgj0+f+U+/EOeziSl8h4otop5a+3DAB6GGyvTNcxnQf99ym:9toNr7OJRPrL9/EiiU2aKk6IcqfDyNzs
TLSH
T14EC10971946EACA75DF3A445B1032E47CEA4716B69297E18EEED2E0C00D74DC1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 30383da81e4a42c95835f25c1b58984852a21bdfcc03351e8fc9c45d80b5bd27
MD5 27e583ad2a2a244dca39691efc943adf
SHA1 365ecce5a05d82cdec72bf5afd5545177bacd936
SHA512 109ef7ff29afba4984cf3347042b3ebc0654437f6add6d0e4e34f2722ac13814d36ba39ddf70c5580de408f5167b62ab1723583165f6c037a19bbbef43d93e55
SSDEEP 96:9bJ0d+Ar2aetJRxW2rgj0+f+U+/EOeziSl8h4otop5a+3DAB6GGyvTNchCzb3oQx:9t0Nr7OJRPrL9/EiiU2aKk6IcMntfRyQ
TLSH
T196C128B1686DACB359F3E556F1032607CEA4717B5960AF64DEED2A0C00E70EC1386A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download