hxxp://southernwv[.]edu

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://southernwv.edu
Sample260821-t1cb4stdkf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318035176256097"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
3624	chrome.exe
3624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4888	1184	chrome.exe	85
PID 1184 wrote to memory of 2940	1184	chrome.exe	86
PID 1184 wrote to memory of 2940	1184	chrome.exe	86
PID 1184 wrote to memory of 4712	1184	chrome.exe	87
PID 1184 wrote to memory of 2600	1184	chrome.exe	88
PID 1184 wrote to memory of 2600	1184	chrome.exe	88
PID 1184 wrote to memory of 5488	1184	chrome.exe	90
PID 1184 wrote to memory of 1240	1184	chrome.exe	91
PID 1184 wrote to memory of 5488	1184	chrome.exe	90
PID 1184 wrote to memory of 1240	1184	chrome.exe	91
PID 1184 wrote to memory of 4692	1184	chrome.exe	92
PID 1184 wrote to memory of 4692	1184	chrome.exe	92
PID 1184 wrote to memory of 832	1184	chrome.exe	95
PID 1184 wrote to memory of 832	1184	chrome.exe	95
PID 1184 wrote to memory of 5972	1184	chrome.exe	104
PID 1184 wrote to memory of 5972	1184	chrome.exe	104
PID 1184 wrote to memory of 632	1184	chrome.exe	105
PID 1184 wrote to memory of 632	1184	chrome.exe	105
PID 1184 wrote to memory of 6092	1184	chrome.exe	106
PID 1184 wrote to memory of 6092	1184	chrome.exe	106
PID 1184 wrote to memory of 6056	1184	chrome.exe	109
PID 1184 wrote to memory of 4468	1184	chrome.exe	110
PID 1184 wrote to memory of 6052	1184	chrome.exe	111
PID 1184 wrote to memory of 3200	1184	chrome.exe	113
PID 1184 wrote to memory of 3200	1184	chrome.exe	113
PID 1184 wrote to memory of 5164	1184	chrome.exe	114
PID 1184 wrote to memory of 64	1184	chrome.exe	115
PID 1184 wrote to memory of 64	1184	chrome.exe	115
PID 1184 wrote to memory of 3624	1184	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://southernwv.edu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffceccc728,0x7fffceccc734,0x7fffceccc740
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,13919259626905850966,12506563709677204448,262144 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,11030938324782362686,3657303862988625732,524288 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,7354007159177238623,10536127960286010415,524288 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,11253973745400638752,17636855872425766814,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,817117941664770128,10025671283670563196,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3908,i,12803731763951029154,18184892274528814864,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4440,i,10412501513938421520,8396015701807011888,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4396,i,7917933834239087560,12795071574544744928,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,3495373429158549468,2952809379175146813,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5380,i,13445133346389786637,4503118506166743219,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,11182910899618911168,10513704555731231872,524288 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,12459978940822094264,8067228078374293036,524288 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,3921214088120749229,13510900035711357518,524288 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5664,i,18014922900014629124,15556489096360942176,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6704,i,13579550396826572487,16126344153201848464,524288 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6764,i,18153585885729871809,1869044186637296448,2097152 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3444,i,1076406626664390785,6835936409632028118,262144 --field-trial-handle=1984,i,12408147580088853991,12035536237481091439,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 601697a0adbe6d978e5c64f3dcdc69bc4380c9d3f6eda4b1e7b082f531ebc146
MD5 e347a81095d1c8024c2b6f91ad6cd8d2
SHA1 5a1c3ee008a180b8362297f3d4afddfcef9a464b
SHA512 deffc6acb2195a5fb7367a80c721ec66e50f7a2327a20c3f38826809a5f0f6f3ef54df4c3475900360d1219eae6eb2d6343fa50331a3e4a59285d9181ed3d5a3
TLSH
T194E02BA9C962EC3B0CFD171DA0500749EA6917573640848B3A3C851C4F7563B469686C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 31KB
SHA256 d46971328b228d7fac89ca0a3453ef058225e16673d44a33619975bc6f613d5f
MD5 5fc2b1afdc0705fdcda6701cab749c74
SHA1 b8b3197e0650f7a68214d2a352cacb498c29d635
SHA512 8c3dff169e06163b68a1f1df49b9de811fded1cfc7c1b441fe055c57c65b4d436a17d9d3e319977fbadbc1fcb9deebb5dc9c602b4fa59eb3db7153ab1286f189
SSDEEP 768:HzrK+Kb3jekdL4lZFERm+HTcsML2A+j6ni4:PfKUlZt+QsM2N6N
TLSH
T177E2F1611F52A0A4AC08E3334349C2B1BA78353BFADD2756F2256386FCADD0671C8D99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 519833a27463e62cb6efe4d39f209cf4e6efea16dc2555f43dd603da1f07fcf5
MD5 5e34ae2f86c079da89e164a68ad02396
SHA1 f8de8d776f93e0f41b95ff250b50b1d21423cfc5
SHA512 f7c3e347aa750db17e99c61dc151cc93261ce36558473a211b974bf0de8565b6740bd12467fad0e428ed1a1994793363f2ac1bf3045aac59ffcb994b8e36c7f1
TLSH
T15311CE2D56DC1440FF204E390C9E0B88233ED568A61A0F0FC670EC7F2E5B3E08D49402
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 c438e4fea0a912fcfdd15cc0985ee41995289aa8cded2639984988b9ed63f0e3
MD5 648f9b330441e786f38a65cc3c3d0c9a
SHA1 87dda8746abc1b9e63cc7b176b305edc901e661d
SHA512 ee5f5e173e94a97991670129a1f91df2e489dafabef3733e078d7e2a615e1e2dfebfc3873423fb9f7bdb9f2bbcd10f69f5de9c6327be3a24f8ed3cd14a0627c3
SSDEEP 192:DKewwcsKm17DyHaaIEd4qi+VE/Dm0VS11aCFSEz6iTbYFxR8BF0DU1i+EucXYg+Y:DKewwcsKm17DyHaaIEd4qi+VE/Dm0VSm
TLSH
T1AD42ABB7CBE4DA3EC95266F46B153E1ACD5D0528532C3C27C9D4EE4B53E28B2D28064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1ee1bf1ac52cc17045af0293c1a0a453e68dd3e03a23ce6af7c2d06db8cdfaf9
MD5 1d65287ba7ae87ce3cb70cac88a70b9a
SHA1 997fc7a1ec78f91a9b5dcf2a4015020b3179f3eb
SHA512 8167399b93bdf9dfcddcdb6eda3fa44d70ab091991ac520ecc79b92aa246b367709f389d063ec184778cfc5b6baf6305a9d2051f9d428172b6284798833dbd10
TLSH
T1044149F7D7D886AE890195E4B6152E2FCE2D0D54532C3C5AC8D4AE0B57E2971D24058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 8dcfc83ca7384ba123974593d773df622ee70fa1e7f7caff0062da0f03f2ec00
MD5 be2c57420dc01ad2563d4fed57cd12ec
SHA1 e7582a5433b311c42fc55f5621684937e4c0991d
SHA512 3824dc471a67e99e4738f677ed4c89877386bdc74977e34cf6faf319e39fb72e8ad381bb6f7efc4e198964b41f18431a29bac066a3d02304e99ea2ca641b162a
SSDEEP 192:DKewwcsKmNaaIEd4qi+VE/DmW4VS11aCFSEz6iTbYFxR8BFWFN9DU1i+Exus:DKewwcsKmNaaIEd4qi+VE/DmW4VS11ar
TLSH
T1CC22ABB7CBE49A3EC95266F46B153E1ACD5D0528533C3C27C9D4EE4B53E28B2D28064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a5273daad826288d66315ee015ba0ae9d8fa25cfe777012240d07063ee0a64ee
MD5 00921b65b8de404fefa978751a519759
SHA1 8bec9dac0758c26f5ca9c099a69b331a74a213e9
SHA512 08497a64b3f43066682a90411bd8f40b3f59c40f1754a925177df6bfed48d16763c312acdc95f239a76fc016ccb8f64bb6baecfb6d7c5448a7c045fbf07b8419
SSDEEP 192:5RkPCQCUEUGdv71hpkPRpbuUQ92Hsb+WNn9GiyXtsNeRkyM4kwUaFPVyIsnAUgE:5RkPvAdBhQXWQwM/eeGyV0arE
TLSH
T15D52D72EA920697B6CDBE616FD117727D7F5002221E12D84EBFCC92C15E76CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7e6f8dbec2d077bb16423304eaa7af7c04b3d7f6c2f0ccdaab48f609e47c92f1
MD5 258ba5f3a02e4297a2d8275de55cbae6
SHA1 99d745d80764b8beacb493574a4b649a79317c41
SHA512 7f8fe35c3790b791d62a49934547d5132a2dc211e6299d7998a39e731654a1f8904e071eeeeba3881b27ceac394b6ca4cfaa3e4f7a98847891d7fd9cdee23408
SSDEEP 192:5RkPCQCUEU1Sv71hpAPRp2VM92Hsb+WNn9Ga6H2jkyM4kwUaFPVyIsnAUge:5RkPv7+BhUXjQwMj2gyV0a3e
TLSH
T12942D72FA910697B6DDBD21AFE613723D7F5002221E52D80EAFCC96C14D76CD212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3c73fba9379cc8bab44975bc8141af29153a9615aa853fbc01d48f477c13863c
MD5 d23b0d9c312a2f12c1e7b40e794cab49
SHA1 d3dea74d27b58addf926ec863ef50ace3d56e092
SHA512 fade37fd49873b214f36d615e160f32a0e6f077fb28c1c72749e0d3c98735bc5fee1bfbb2a142cb6af8b930973f6cdf871f4b0cce2e9c18da576db75e3fb8d60
SSDEEP 192:5RkPCQCUEUG7v71hpAPRp2uUQ92HX00b+WNn9GiyXtsNe+kyM4kwUaF1VyIsnAU3:5RkPvADBhUXFQXnM/eeXyV0adE
TLSH
T15A52C62EA920697B6DDBE216FD117727D7F5002221E52E80EBFCC92C15E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af131c7b0c1154d80df2ca3df89c102381003f5e89afa736186162f18b6ee52e
MD5 0e1dc4d119c7ee5899cfa97c8177db35
SHA1 c880b65aa95fa349b4dc71403ea644535190d868
SHA512 6a07370ace2c039ce911e9a42fb9b089d17f4729d966335249b6c871699e43eeb65c2a0556dce754aae3334c6f859f8b3b4a47bd3bd4d76dcbe9b324c552b02d
SSDEEP 192:5RkPCQCUEUO7v71hpAPRp2VQ92Hsb+WNn9GasNeckyM4kwUaF1VyIsnAUge:5RkPvsDBhUX/QwMfe1yV0ade
TLSH
T19342D72FA920697B5CDBD21AFE113763D7F5102221E52D80EAFCC96C15E76CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5fb5a4090203119ee0efeac926354ddc412af789da6bd54bec1bc43f3f42ea8c
MD5 4957e47b451bb5ab4361fa9770750253
SHA1 fd8016832b008211083b6031a785908b87acb0ee
SHA512 f7da5b24aaac145384f1e08fba2940221043b60060a41a59b2a888382c78cbcec35fd5fed24df94b0f8828e1e4710b3d21bf47c4f51d93af7266c8c8bac1a30c
TLSH
T104B0120080015102C08603F01152548871145F289E0A1B0183F47D23CC251718129050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58917d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58917d.TMP
Size 96B
SHA256 464bc701321f23d402b30ab4c569d8d40d74a5b15c9dea468b4fe5bdbc23ce39
MD5 02ebe12b75aaf911110747870f585b48
SHA1 62318aac68fbc458b7ad9de1d254ed5337f1d8e7
SHA512 0786b1c63373c36cd572bc276b6a505f654f45c36dae3cad06fa461e2c9021c5cffb26b806f0a1939234534be33cfa6198df1a47b01b5999580caee3b00f149f
TLSH
T159B02200C002B20BC0030BB02E80C0E83020CF20CB03030282F00A3ACC22A330030030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 6fd4fcd3a457ce669577b998361520448a252973b3521b51f3f59643b60e61e7
MD5 65647b2416dcbe58299880664ae3722a
SHA1 c6bbdca06d6e113182f25465541ebf4fc3af9249
SHA512 0a56c82833d88e8471bee263535bbb6211ee1246bf2aca2cd5d7253e94e168dae87cde458cca4335cba1350a89480ecea2d7591f96853236e8fc8e2443dd36a5
SSDEEP 3072:oh6fFaEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:W8Fanm7Rkm1tYpBeh2BAo3
TLSH
T163F313279C79AC7B9EB4BF0EB08D0F2E2EF11952C920DE57C4E55A4037EE5C81949938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d2b53b4d5db83de183bb5833af8512a792ce17e348f221120643e2e0978f5f4a
MD5 71fe28a15d4bd8101ba3121bee617467
SHA1 ff850358f17eb6fb0c3f7b0eee8462963f3b8cea
SHA512 9d8ee6ef87d3f88bfe2e57f2e86137b00bbe849d8fc582e92f90f724a1cee362968a0317622d4b2b0b1f4b35a1ace94ebd36bf074c6e068a42e7839e9fc1c4a4
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:/m7Rkm1tYpBeh2BAo3
TLSH
T135C3122B5D75BC365DB9BB1EB08E0B1F1EF24AA6C920DE52C8D45B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fc9b7348b32175dbc5da2a2c2bd52ddaa303bb70675bc9a2d2f300d36abb52eb
MD5 b5897cc5b522dfc13d2a8d637415192e
SHA1 0a545061fb64012672aac4e325fa497e26609e8a
SHA512 cb29ca512658167c0da17ebbed0bf0b3a25060bf301c7402358ac532a098e5bc625ef9d04c1502819844f3ce4a3759614db6477879321063234b18461ad5f69c
SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:rm7Rkm1tYpBeh2BAo3
TLSH
T136C312275D75E9375D79BB0EB08E0B1F1EF14AA6C930DE92C8D85A0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 84ae270d05627e08847897050053271125625293ca32b4bc90975699f279d8e9
MD5 057264f1e2142631e4e0eb9c885bcdd5
SHA1 103f070710e1523fe922e4c78c9cc739f9ace085
SHA512 19910c09ec1918ac8a8894073042d4b1f95b73a3a705f63808a2a586861b9090118c8cd8a0ea95a711dc821698f6872d5b7a62eec407cdd2416216998b573dfa
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Jm7Rkm1tYpBeh2BAo3
TLSH
T185C3122B5D75BC365DB9BB1EB08E0B1F1EF24AA6C920DE52C8D45B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download