d95ae7b09fc599fa5ef99c04131117f9b8f9432b3b4aa9cf8492535f8d71ceae

user interaction
yes
max time kernel
142s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcd1cdfe358c3b7c95e10cf72dbf727f_JaffaCakes118.pdf
Size 93KB
Sample260824-v4ahcsec93
SHA256 d95ae7b09fc599fa5ef99c04131117f9b8f9432b3b4aa9cf8492535f8d71ceae
MD5 fcd1cdfe358c3b7c95e10cf72dbf727f
SHA1 7c5c487471db6b1702085fd880a931a819baa264
SHA512 30ca7a429aa4b1b3a877c6b8b83e3f957c2cb5a7a06d2ad63e0be5e85ade27f0d3255d8c0c671150013c01546369052882f5db77997f3980148a8b7a3a47caa6
SSDEEP 1536:UHedaEV1N3QjlwBgiZDASIKwJJYut9OLod6/d3Vb4fcXwWx+7oRW8pO+W/O:Kedai/3ywBgirIBL1qd3VbrXp+7ow+D
TLSH
T14493D0BEF64D4CCCE0E3CB86DB32F9AD467E721759CE20C035340A93B4691A956462DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1572	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320663386924602"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4260	AcroRd32.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe
4144	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4260	AcroRd32.exe
4260	AcroRd32.exe
4260	AcroRd32.exe
4260	AcroRd32.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4124	4144	chrome.exe	90
PID 4144 wrote to memory of 1808	4144	chrome.exe	91
PID 4144 wrote to memory of 1808	4144	chrome.exe	91
PID 4144 wrote to memory of 1572	4144	chrome.exe	92
PID 4144 wrote to memory of 2524	4144	chrome.exe	94
PID 4144 wrote to memory of 2524	4144	chrome.exe	94
PID 4144 wrote to memory of 2588	4144	chrome.exe	95
PID 4144 wrote to memory of 2588	4144	chrome.exe	95
PID 4144 wrote to memory of 5144	4144	chrome.exe	96
PID 4144 wrote to memory of 5144	4144	chrome.exe	96
PID 4144 wrote to memory of 2624	4144	chrome.exe	97
PID 4144 wrote to memory of 2624	4144	chrome.exe	97
PID 4144 wrote to memory of 4720	4144	chrome.exe	98
PID 4144 wrote to memory of 4720	4144	chrome.exe	98
PID 4144 wrote to memory of 5344	4144	chrome.exe	99
PID 4144 wrote to memory of 5344	4144	chrome.exe	99
PID 4144 wrote to memory of 3000	4144	chrome.exe	100
PID 4144 wrote to memory of 3000	4144	chrome.exe	100
PID 4144 wrote to memory of 4556	4144	chrome.exe	101
PID 4144 wrote to memory of 2568	4144	chrome.exe	102
PID 4144 wrote to memory of 2568	4144	chrome.exe	102
PID 4144 wrote to memory of 5404	4144	chrome.exe	103
PID 4144 wrote to memory of 5404	4144	chrome.exe	103
PID 4144 wrote to memory of 5904	4144	chrome.exe	104
PID 4144 wrote to memory of 5904	4144	chrome.exe	104
PID 4260 wrote to memory of 6092	4260	AcroRd32.exe	107
PID 6092 wrote to memory of 2540	6092	RdrCEF.exe	108
PID 6092 wrote to memory of 2540	6092	RdrCEF.exe	108
PID 6092 wrote to memory of 5412	6092	RdrCEF.exe	109
PID 4144 wrote to memory of 5876	4144	chrome.exe	110
PID 4144 wrote to memory of 5876	4144	chrome.exe	110
PID 6092 wrote to memory of 5488	6092	RdrCEF.exe	111
PID 6092 wrote to memory of 5488	6092	RdrCEF.exe	111
PID 4144 wrote to memory of 4276	4144	chrome.exe	113
PID 4144 wrote to memory of 4276	4144	chrome.exe	113
PID 6092 wrote to memory of 1940	6092	RdrCEF.exe	114
PID 6092 wrote to memory of 1328	6092	RdrCEF.exe	118
PID 6092 wrote to memory of 2388	6092	RdrCEF.exe	119
PID 4144 wrote to memory of 5008	4144	chrome.exe	121
PID 4144 wrote to memory of 2856	4144	chrome.exe	122
PID 4144 wrote to memory of 4900	4144	chrome.exe	123
PID 4144 wrote to memory of 6048	4144	chrome.exe	125
PID 4144 wrote to memory of 6048	4144	chrome.exe	125
PID 4144 wrote to memory of 5732	4144	chrome.exe	126
PID 4144 wrote to memory of 5732	4144	chrome.exe	126
PID 4144 wrote to memory of 5072	4144	chrome.exe	127
PID 4144 wrote to memory of 5072	4144	chrome.exe	127
PID 4144 wrote to memory of 2836	4144	chrome.exe	128
PID 4144 wrote to memory of 2836	4144	chrome.exe	128
PID 4144 wrote to memory of 1292	4144	chrome.exe	129
PID 4144 wrote to memory of 2528	4144	chrome.exe	130
PID 4144 wrote to memory of 5340	4144	chrome.exe	131
PID 4144 wrote to memory of 712	4144	chrome.exe	132
PID 4144 wrote to memory of 5728	4144	chrome.exe	133
PID 4144 wrote to memory of 5728	4144	chrome.exe	133

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fcd1cdfe358c3b7c95e10cf72dbf727f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3466A40E43A1BAE12D1A82801B332ABE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3466A40E43A1BAE12D1A82801B332ABE --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DBFC9868B207758EE8079951266BE8A5 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EB96C3AABAACC7839516BF579A72BF11 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EB96C3AABAACC7839516BF579A72BF11 --renderer-client-id=4 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BACCEC3EE62978386AA097FB18BB2AD1 --mojo-platform-channel-handle=2720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=430295CA4A0AE9634362D0B1FE60CAD4 --mojo-platform-channel-handle=2060 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1328
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CE0AE3008B80F25C0153FBA59A49F497 --mojo-platform-channel-handle=2820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff975bec728,0x7ff975bec734,0x7ff975bec740
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,2298976301145292569,9245654486743517335,262144 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,6105097546720714980,17838543883629930161,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,11943323035921476654,18304067510766763487,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,9941026646385863177,11257744138733188018,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,5441538234583605273,15498413988022591312,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,8309961336185011484,9900096964342374697,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,13741402421260140492,2638833248750134006,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5336,i,17468779586888654953,12612183231143363555,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5576,i,9466966580294915653,11698011001197896194,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,11340962021019451729,7990603242483645681,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,16592337617676538954,3641318190824081623,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5832,i,16587228650466474437,17328536495488666138,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,332678210963760747,8695447597160545195,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6356,i,16050650273302712695,10635350310303497507,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6492,i,9602158204068538280,16852646693366399880,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7052,i,1178041875934584763,17953993052128437560,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,5716473949876854830,16937855816422469947,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7004,i,13405178781927775162,4050357833906852311,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4732,i,6328463937880152,9560960501079817870,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6556,i,11547734727014890834,9509537765347967542,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4728,i,6636658216114206083,6128283414148248976,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6648,i,17439890940045052063,2612008398725334099,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,12236468945794560628,12448391293650046521,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,2448352287482801040,3402001509532003812,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,2196796481255259233,11725117381026526237,524288 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5876,i,14239814541761798210,6384091191011977287,262144 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:10
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5880,i,264308805374191187,2236461430276696297,2097152 --field-trial-handle=1856,i,6475080010533150178,12900175850798803595,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 f78d30e0d31afb7dd72f61a47cf956006fc5818adc7e109d42f20f2721eea042
MD5 b06a9b78834e34e5dc4a71b4c447e7f6
SHA1 fa142e33b69816fe3aba9e544df45d1280506b4f
SHA512 64df9bcd6b4d687ad810b7f59382af3ab2098b275709cb66417e26bce70fce3aab2b170a19967c402cc6fcba5d9de53abf8504d2613b291d0ae8fa36a8739c3f
SSDEEP 384:ijetdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:iZ+eUZsLQCZsL3hUS4
TLSH
T1C153CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 8126bb1b329ac91b0c52e8160cc2304fe3ada1e7bb177f3e1b0412a8bdfb5b83
MD5 bcbdd0a30e8801385eb278c43a30a977
SHA1 40d9d1d9c18e6bdbf629cf641662ca50f6a07989
SHA512 2c03b6563e7586abfde2a5b337f706658fe250e62bf4d705bd4c144b1a1e0c5af84e482c9fec50f2acefd102c761d4197edebc15f5e2b1347b89289411fda280
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 0ab80c8ecdd7304998e1ab041f8bd7ae7e0324052cd83af976397113d979ad1e
MD5 695112fbab25a3ac3d7d08c7cfadcc04
SHA1 300bc4eca9951cf1cf18514bb61044d0c7677eef
SHA512 1f9622394765f1dd7427adf4d5f932e08ed5ec7f6c22c10e8e1005de3b0a40d6612117305edfd90fd45b093f57b4fbe68f67af960d7465c04b789dd37e361db6
TLSH
T195F0269212850C35FF906DF037FA24B8AE3B4698544607EA42D84BCD205337B00894D3
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 14dd564dd2d4ce524e92c715d290a09364301f4b7cfbe8d88343cb530765083a
MD5 2befdea6700f46b9f25f3aabc962cd2c
SHA1 c166dd04d963bdc920e837f03d588fb7d7b27a63
SHA512 73efdfa64669c3265a807b58b4462a04041628f2a4035bf30114011df878d591b2979c9723cceac4556ea1486e55bceb12b227545ba08248a4031897a895b103
SSDEEP 96:DY50XGBXIaHEcVG1cBHkNPFaPQfPmntcZ2:DY50XGBXIQEcVG1cBHkNPFaPQfPmntcs
TLSH
T19FC1CDF7C3D9C57DC91156F49B156F1ECE2A1A18032C3D26C8D8AF1BA3E28B1E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4fba11739b0079e651f17036152b9d686598f49e74c2bd2904d732d17f6a8370
MD5 c0743816b1bb628d014c77a2036d2fdd
SHA1 e19ec7b6275997e9d59b5d235e4516c02df65469
SHA512 897edcaab6f6b064258174689946d92efa298d40f7b7d3ab14b8c49b7e66be4ae1deebeb020ab9916e6a5024b20b31f96cdda0e326a2d9d01dc9ff30dbf5df0c
SSDEEP 96:DY50XGBXIaHEqYDVG1cBHkNPFaPQfP22E:DY50XGBXIQEqYDVG1cBHkNPFaPQfP22E
TLSH
T1B3B1DDF7C3D9C57DC81116F49B116F1ECE2A1A18031D3E26C8D8AF1BA3E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b4b095d0197aaae50d2ad3e7e7117c4c1de302650ecbc2e2b895f1989f670a7
MD5 e932e4d0ad2060429730a7bdc2074f27
SHA1 3abb090bc130e1be8a3fefd197711514dc357525
SHA512 b9bac882e3ce1dc57ca891b9410e1d48211c0b20e2951fd806bd142b7366040298c1fa68592e37ce2e46ebdf971e992846b69dc8213581c8a10240ac5b4ba83b
SSDEEP 192:DRrcBzloZbv7xhQJPRp0Q6c9GHsb+WNJoI2WsaEykYses2CBbsVyIsnAUgL:DRrmzlwjrOX3gwU0E7YO2CZIL
TLSH
T18042B81AA920693BBCD6D219FD627B97E7F5102271D01E84EBFC4A2C15E7ACC321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0c9535d1641fba678d114d7ddbe1ad466af0778aeef07616607659e74fd197d7
MD5 6c7625711a4c91a38f182871e9d1e25c
SHA1 466944807d837f6cc42e3832f718eb9a45042826
SHA512 da7ed0d1136cb6e3a5356b28203e43b61532c364cda9ac77513e6fe966a88a9ec1863e58e170255c3ed50ee25d9ec94161b40f12da33f8f1c4f6914b4b3c7dac
SSDEEP 192:qRTcBzloZtv7x4APRp2Q6c9GHsb+WNnvs4zo2mkYses2CBzsVyIsnAUgR:qRTmzlwN3XVgwUL2vYO2CdIR
TLSH
T1CD42A72EA924693BBCD6D219FD627B97D7F5102171902EC4EAFC4A2C14D39CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 516b0c04facc93e92ebd5f55276ffeaff5b81866439437695111acc4f6d8a55b
MD5 141fb337b3d10f1e84be415bc7c62a42
SHA1 24b11fa8e043c54e3deba747a4392773fd0fc058
SHA512 7b3b0db30c3cd4a8438c51364cfb6772b61b38f57d333d16575481c1ae316cb4ccb038b99f39a58fb6bdd57826792ebdad6ee2921fa69fcf18f3ff4af9719161
SSDEEP 192:qRTcBzloZbv7xLJPRp0Q6c9GHsb+WNJovs4saEGkYses2CBbsVyIsnAUgL:qRTmzlwjLX3gwxGEPYO2CZIL
TLSH
T1B442B81AE920693BBCD6D219F9627B97E7F5102271901EC4EBFC4A2C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 edde5421ea1dc8b1950671d9ab7513ecef99790dd924578b2767797b1c7078cf
MD5 66d9c916509194d0b1cb005f23a2de35
SHA1 f6328e00be1f2faa5d53192aa58096aca015fe56
SHA512 5ce4f2f38b01f8b36fbac098773a980626f6f6c6d512784c0520fdfde8e9fb9438a0eeb069a80a18f6a0560b63513f5a26d5ee274948a67c01dd06836c1faf32
SSDEEP 192:qRTcBzloZSv7x4JPRp0Q6c9GHsb+WNnvs4saEGkYses2CBbsVyIsnAUgL:qRTmzlw+YX3gwUGEPYO2CZIL
TLSH
T1F442A81AA910693BBCD6D219F9627B97E7F5102271902EC4EBFC8A2C15E79CC321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 68b01f983e145d4e97954deb1ad720dbc1650a973e96a6a762bc3a26260b4849
MD5 fabd98b872999889241c159633fb1050
SHA1 7579c8c5c3eb337764d8205ff0fd761707179642
SHA512 478dc8faf5973d4597b6fd25a7803132e61cd5b58e6b441f05fd32f50e573557f033511e57fee5cee63e97ffb688037c2f7ff22dd7835c0e9159a1543489624f
SSDEEP 192:qRTcBzloZTv7x4APRp2Q6c9GHsb+WNnvs42lepkYses2CBVsVyIsnAUgL:qRTmzlwr3XVgwUTeOYO2C7IL
TLSH
T1BE42B91AA910693BBCD6D219FA627B97E7F5102171D01EC4EAFC8A2C15D39CC321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b40396798e5f508a2241b731220c3e8dc7ec67be6ebab527e0199ddc60f60cf
MD5 9e820063924f6a338c9fa855dc98919b
SHA1 b0572fc3093085c69ed25066107e824900f8b65a
SHA512 6b7ea7df26159c1965f4889d070664bf0b73217f423b2c5dd6512cd596630c1b07bd032cd501da196088c799c673f799f99ae9ca1ce89101c0db379e90719fdc
SSDEEP 192:qRTcBzloZ+v7x4JPRp0Q6c9GHsb+WNnvs4BfYXkYses2CBbsVyIsnAUgL:qRTmzlw6YX3gwU+YUYO2CZIL
TLSH
T1E942B92AE914693BBCD6D219FD617B97E7F5102271902EC4EAFC4A2C15E39CC321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9066b3864760ac9947a7b91101e49cf360fba04362ef0ffb8fb38eacdf4b2b08
MD5 d25cdca9c04d7dce8da27285b8f10b1e
SHA1 5bc80e00b4405726796fbce3ec41c74415c6e96c
SHA512 7ec035828cb961498c670ac0f16a4e57a6cb47255ee057ad0ac1d5e07b42ee5ef24f4ecc6bc8c045b09e653b22f5d20171150a9ba195a8074d256b961ad4b79a
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9AgJiMna1S:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFO
TLSH
T12832D967A48D9A3E0FE8D50DDC166B4BACB4025672680C2457FF9D0803E57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9e31b0ece97d919304504764452031c93dee3cdaa3871afbdafe70b0087a045f
MD5 7758b3641ed3b5fab074cb14a09745c5
SHA1 3dafea5da2eda9aad45e4329fea3d74003a925db
SHA512 f38b6da6df85b8e77a37e459711c3c5363c8faf9173e29ba1f3245c43f02a74e115e269b1248869a747fa043b14047e4c322b076d12f2a1106435dc94b24a080
TLSH
T199B022E8A0200C33CB0883F200C28C203320BC0022C3C30B2FB2B088C8022A002020E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 416301e839508932babc891888c12d64a62ee869bf7cc9fb2d1d4519b6f8df1e
MD5 54a3226b18541f4cd22cc114bf194409
SHA1 0eaaafffb966ff2648118be5eb4593150ba903cd
SHA512 a08fadfdf45500c5c78a8cdd1fa38e7e6b52be411cdb9037bdfa226f3478226b221b6c596c178c2cbdfaea9f2a6a0aa1c22c9ff22d3ce53a284c4d0270e58c92
SSDEEP 3072:pqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS91:pqy/WwnA4FFLge1
TLSH
T19AD31232986DE8533B7E93BC0308D95EBE40421E02465D81FE7E2E7D82975F1977AE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 543e510b82a5d2c47ef81461dd599dfc78bc38e6eb2aa12fa3b775744e1b00c5
MD5 ca65185175e513393b0109b1391c2e15
SHA1 64cab42f5ae1c4416f332e1ed4029a20d44e9565
SHA512 cec6f76810d057bd07384618839c771c7e25ab51ea0b5d018f33f8c1413357e3e37ef11f7dca701ea403796416bc0a5fb69a6d13b2b09b955312d10ee68ebbb1
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5xcDGB6gGyvhyLfOLYEbZP9v4a:SC0JeGnpDUDUWE1mLYEbj
TLSH
T1F4A12B71F06CD97384B6A849F9822A43CDA521ABEA31AE44EDD95F0C02FB0EC0342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 1c13b35f4e9431443a24c53a9a77d2b93024d089bc829b4edc0f433ef5004ce2
MD5 c96f371dbf7de3c05512a674c9d7d26d
SHA1 b9c67740bd7f006be959c4afe3cc6a51f76dd70d
SHA512 b96009e694710c3be8acc66d445ff8469917fe885e1a6b52c017856d4afb81562803061960bde047a6395f9c7a47dc2e0f5db9648ed085e3f16294e6ef9921ea
SSDEEP 3072:jqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS91:jqy/WwnA4FFLge1
TLSH
T135D31232986DE8533B6E93BC0308D95EBE40421E02465DC1FE7E2E7D82D75E1937AE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 1860b5fae964c50ece947730e8f1d1e619d74b6718894baacf37cd9d8abac33b
MD5 554ddffa0bd56ac9d3e6f21a58d421e1
SHA1 7d3992093612af366adeb78886abfdfe7072648c
SHA512 f8dcefc0da93165b785fd42cee5e690e31ee943ab4ec88568f8768df6fce5fa07c547b178caec7861cd28ea9206e97b1be5b44a2c237b7e0ead153646a499810
SSDEEP 3072:2qJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS91:2qy/WwnA4FFLge1
TLSH
T14BD31232986DE8533B6E93BC0308D95EBE40421E02465DC1FE7E2E7D82D75E1937AE61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 dbda523330216a546ef97d2f74bd2fc97185c82be4881ec4a9df2fb69cbc8f96
MD5 d27e57e7a018820d87d5eccbfa3a406b
SHA1 b207c4915269328615ec1e23b2c3e46d5c4c7f84
SHA512 f56f755a481eff72dd7c2ebac5d6d05c6b778b6c7360de0ead5b967cb93ffcdaf977e573906ff31b0985f6b75d0e8c31e0cdffc3eef5a15dd36b10f890f853c5
SSDEEP 3072:wqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS91:wqy/WwnA4FFLge1
TLSH
T15DD31232986DE8533B7E93BC0308D95EBE40421E02465D81FE7E2E7D82975F1977AE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download