168d87effedb1e5980694e9a6c53a6b412b45455edb26979da0d9ac15c89266f

Analysis

user interaction
yes
max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sight-Word-Games-Editable-20-games-with-Auto-fill-High-Frequency-Words-3858121.html
Size 393KB
Sample261014-adn8lsdg79
SHA256 168d87effedb1e5980694e9a6c53a6b412b45455edb26979da0d9ac15c89266f
MD5 4ea921ce4b9402514014285bfa594a38
SHA1 8abc7bb56bd3108148ca7ca1886c8045cc37122b
SHA512 91bde12b4a06185729e5580bb82ce60477c700ceb2e7e03ea00f384833d67bd855392febd8ae5bce8cbab7394ccba77260cc8d0d2ebc292b922b0fe424c6db42
SSDEEP 3072:iAj5KnE4Y3Y3Y3YzY5yin2uiuTPY3Y3Y3YzYUauiuTVY3Y3Y3YzYgY3Y3Y3Y3YhO:wn0yinLiuTrPiuTFYhE
TLSH
T1308473B694B8232B051F56A5F532974AEFE3C49CC4462CC19AAC8AD81FD3C91CBF9417
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
1384	chrome.exe
1384	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1856	4704	chrome.exe	88
PID 4704 wrote to memory of 4644	4704	chrome.exe	91
PID 4704 wrote to memory of 4968	4704	chrome.exe	92
PID 4704 wrote to memory of 4968	4704	chrome.exe	92
PID 4704 wrote to memory of 2040	4704	chrome.exe	90
PID 4704 wrote to memory of 2040	4704	chrome.exe	90
PID 4704 wrote to memory of 2552	4704	chrome.exe	94
PID 4704 wrote to memory of 3724	4704	chrome.exe	95
PID 4704 wrote to memory of 2552	4704	chrome.exe	94
PID 4704 wrote to memory of 3724	4704	chrome.exe	95
PID 4704 wrote to memory of 4492	4704	chrome.exe	96
PID 4704 wrote to memory of 4492	4704	chrome.exe	96
PID 4704 wrote to memory of 4820	4704	chrome.exe	97
PID 4704 wrote to memory of 3324	4704	chrome.exe	99
PID 4704 wrote to memory of 3324	4704	chrome.exe	99
PID 4704 wrote to memory of 3512	4704	chrome.exe	100
PID 4704 wrote to memory of 3512	4704	chrome.exe	100
PID 4704 wrote to memory of 2928	4704	chrome.exe	103
PID 4704 wrote to memory of 2928	4704	chrome.exe	103
PID 4704 wrote to memory of 948	4704	chrome.exe	104
PID 4704 wrote to memory of 948	4704	chrome.exe	104
PID 4704 wrote to memory of 5456	4704	chrome.exe	105
PID 4704 wrote to memory of 5456	4704	chrome.exe	105
PID 4704 wrote to memory of 2248	4704	chrome.exe	106
PID 4704 wrote to memory of 2248	4704	chrome.exe	106
PID 4704 wrote to memory of 5976	4704	chrome.exe	107
PID 4704 wrote to memory of 5976	4704	chrome.exe	107
PID 4704 wrote to memory of 5380	4704	chrome.exe	108
PID 4704 wrote to memory of 5380	4704	chrome.exe	108
PID 4704 wrote to memory of 2744	4704	chrome.exe	110
PID 4704 wrote to memory of 724	4704	chrome.exe	111
PID 4704 wrote to memory of 3912	4704	chrome.exe	112
PID 4704 wrote to memory of 2360	4704	chrome.exe	113
PID 4704 wrote to memory of 2360	4704	chrome.exe	113
PID 4704 wrote to memory of 4216	4704	chrome.exe	114
PID 4704 wrote to memory of 4216	4704	chrome.exe	114
PID 4704 wrote to memory of 1384	4704	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Sight-Word-Games-Editable-20-games-with-Auto-fill-High-Frequency-Words-3858121.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc74acc728,0x7ffc74acc734,0x7ffc74acc740
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,9104718831544348033,7969105564040170855,262144 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,15761317018944302461,8902391870147361798,524288 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,5079549967516543436,9078035757491221860,524288 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:13
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,5328600576933201023,14475618752020105962,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,6787919469578214334,6977915873015132491,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,5948884815098326343,10069351402463463506,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,8399870660453160373,3367297788437167157,524288 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5816,i,9761275701281124022,18022659022138714194,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,16132753223451545675,10838509564362305665,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6160,i,1314684835866883334,18046803832867903341,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5116,i,5012616722045671645,16553423554703639850,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5848,i,9804867413199328225,7471160137180713291,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5760,i,18335195202668709350,14752833985694092758,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4912,i,13303158034840597155,9066753187767270959,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4884,i,15555531970034906103,13766418874983866253,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,3573486166923624700,15594604621581526744,524288 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,2218974168180549369,17217805077571695248,524288 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,7925663142521632820,15167362512233198600,524288 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4592,i,4232556273527144776,6725484656564145447,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5752,i,12565636999168332639,9560264194264230023,2097152 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5880,i,17990392360895910191,17987725308195311475,262144 --field-trial-handle=1916,i,2871229594620470529,2894380346254049696,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02f816c1-8d02-4c55-a314-92655b27d735.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\02f816c1-8d02-4c55-a314-92655b27d735.tmp
Size 5KB
SHA256 d6fd588db8c09d5ed7c3e33014de0f7490931ef366fcdff9973acd5dfb2d6ce0
MD5 f7c70ea0ced304a638576b385a1456a7
SHA1 364acec00427f256e265a82ec07327395ed53750
SHA512 c0d49c4eba9b1bd4bbf22f0880db51072021a3dc2862289035b224ecae4491be649ca5f7e60ec044b7f585cd1b919dbcdce7108a39e7ae7b027c3c38dce8d9ef
SSDEEP 96:3bJ0d+qJw6eq8Em6eifKcIzSNoxvSl8h4otop5tAdDJB68GyvQH4Q8TBl/3nJN8R:3t0xJPz8/Ck3xtiU2tIPwr4Q87nJN8UK
TLSH
T17CC11B70B8686D7798F7D591B1432507CFB87157B6149F90ABDA0F1C01DB1EC2742627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35ecceae-03cf-4cbb-a1f7-a00c54bb9d74.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\35ecceae-03cf-4cbb-a1f7-a00c54bb9d74.tmp
Size 4KB
SHA256 9d610d6d612eb8af385aa2123165dcc1b86343a535a7f5f62dce8fb65403a016
MD5 a28f0402b59c652e76235ae688203ffe
SHA1 9756169cfdf811c4b76a586fc770a264ae0cc758
SHA512 9cc22986a425cbbccba8a519304e5aa4c92d74d4cc9f9d816642ba663db074f669ae92c74e2db44a4c23e79e029271281acda2c2fddc856a0d15c60d95dce4e4
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5tA8DJB6vGyvQH4jYN0bblDv4a:qC0xJPz8/CkqDUDt7Pfr4jYN0bb1
TLSH
T173A11931A8695DB7D4B6D585B2432A03CF64B197F621AFC0B5DD1E1C10FB0EC1342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4922e84e-7b9c-4f0c-889d-994c363c1e7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4922e84e-7b9c-4f0c-889d-994c363c1e7a.tmp
Size 5KB
SHA256 a94ff7598607d8d77d637b0b61b3082b57fc959be7f26e437629876ab59dd1dc
MD5 2b326e8f2a01367e4123be2d5cdaa59d
SHA1 3604468ff189044e4d520ce3d5c65d271d4670ca
SHA512 ac4b080943851f2cb01b8b99f1a32c0cec98e25e690790614d57724543a61bf1ea487209f0d928419668775c7fd7ef215316236e1f68c6d3a8be3a495cf45f6b
SSDEEP 96:zC0d+qJw6eq8Em6eifKcIzSNoxvSl8h4otop5tAdDJB68GyvQH4Q8TBl/W4JN80w:zC0xJPz8/Ck3xtiU2tIPwr4Q8K4JN8UK
TLSH
T1C7C12B71B8BC6D7798F3D591B14326078FA87157B614AF90ABDA0F1C01EB1EC2742627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fc55640-af80-4ede-9487-f26dbeb7fda9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0fc55640-af80-4ede-9487-f26dbeb7fda9.tmp
Size 11KB
SHA256 1c8f8300a29912bf5eb6ec32e5474eb9a089680c19505de8a9c6d6850deb8ffe
MD5 99d21fdaf52592174f948c72a00fc4ad
SHA1 c5e2d52efb9e8c52267616309de49b2f960b5709
SHA512 8e793ffdf20ac7c9f2adf9b0c210d4e2028f1d4f0f50c7f857b522f9bee2b5ff69c53ac4862a6e56700f965540e2091c444ec2997c0c33913b19f80016a86aea
SSDEEP 192:vRx7AFLvv7DvAPRp2DG9bHsb+WNnaIaPh5ay7a9NCFVyIsnAUgE:vRx7uLn/6X9BwaJPakaDCzE
TLSH
T17842A529E910753F9DDBC22AFA627B97D6F5102131C42E84E7FC892C25E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fd91a4c-9487-4101-8801-c2b4aa2f7193.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2fd91a4c-9487-4101-8801-c2b4aa2f7193.tmp
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32b4f818-1e10-4a00-882f-a09c75f8d422.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32b4f818-1e10-4a00-882f-a09c75f8d422.tmp
Size 12KB
SHA256 2db6237a81832a54f0ed882d1f340a721301bb912c3546bbe5de24506ec59962
MD5 045315226710c3b4301c6e2266fc4b11
SHA1 62a8baaef2b2618669ec3843f7a4b21ff7d92408
SHA512 e543482833ec7a672eba98c2526c5e9c31af41061c7dde5a375df78efef98846768aed1c44b115f05d6fe4168cc8db31cee51972030f153b79f0f97f6db199ad
SSDEEP 192:3Rx7AFLKv7gjPRpHDG9bHsb+WNn3E0x5ay7a9rCFVyIsnAUgE:3Rx7uLGMXqBwU0KkaJCzE
TLSH
T1B342A32AE910793F9DDBC32AFA627B97D6F5102131902E84E7FC892C15E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60ac8362-ecd8-4471-866c-850882fce13a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60ac8362-ecd8-4471-866c-850882fce13a.tmp
Size 12KB
SHA256 5c773c1d0bc2a889ceb0283f39216c3f75d33c3e73afb598bcd18d0b1c8f19ae
MD5 0ca0e0e8185452aa371f115f89407580
SHA1 70caeb26d02e3c44d72ff5dec3c793096dcd5de6
SHA512 098765cca107ba53609a900f3b65ed874da52597e9538a19742cd6873f1bc60c8b0473a6f86aae5e915438d8058c081dda2a424cad70a950c7240a1100f58100
SSDEEP 192:3Rx7AFLfv7sjPRpHDG9bHsb+WNn3E0x5ay7a9rCFVyIsnAUgE:3Rx7uL3wXqBwU0KkaJCzE
TLSH
T13642A32AE910793F9DDBC32AFA627B97D6F5102131902E84E7FC892C15E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 e9a22af685f7d6700fcbef1cb34c7b92fcc023d2d4e067a6a97c5eea39177c8d
MD5 fce36f437627efd2dcb0d75ff623613e
SHA1 7935aca7bdd5389fccfd075335ac9f74afb86132
SHA512 d479183c6847e30dc71e32f512fe5101968bae28927fcee7d289415102018b98d727459b528963920aad9b4508ec8ca332ce36d4920bc31957006b26752fe3d5
TLSH
T1E8B011C880800002EA00233008E200823A200EBE0A022222A3CAC0A0EC08BA003A3288
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2403ffa6-e167-441c-b70b-eb176d66950b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2403ffa6-e167-441c-b70b-eb176d66950b.tmp
Size 4KB
SHA256 210abe380e1bb6eaaa246027fe0ca25a0399fee2cbb0ffd8fa1d397dcff827d6
MD5 1f983712bfbc4597f33c54d7b69f4558
SHA1 8f5f1f72029eec978f9e33e6a52e64b2fd05d517
SHA512 9c0c5d710c55a8c14d832e4ef71b8f1863a36167f72415634ba5ae80ec45c135460d9e6ef8b0cd734b4a7e00091353293e3084a92095c617973f08af85fec64f
SSDEEP 96:DZg6DM1aIfKqGyuXo7uZRGNZA9QbL0IR2:DZg6DM1aIfKEuXo7uZkZA6bL0IR2
TLSH
T16FA1AEB7C3D4877E881156F49B257E1ADE2D462A522C3C56C8E4AF1F63F1472D20128F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42ac08a8-f662-4701-bc7c-2fcf959f9349.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\42ac08a8-f662-4701-bc7c-2fcf959f9349.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d84436db-a5c4-4f90-8b70-bb2087341dc2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d84436db-a5c4-4f90-8b70-bb2087341dc2.tmp
Size 12KB
SHA256 08d3b329db0902d47727e82a918413ad41fa1356957825d4bc3f9fdf5d168cd3
MD5 9918cf211bfa6533ed8be0bedba17484
SHA1 d6639f133370918baabf6cafb957aa001dbd04a8
SHA512 ec827040a1a0898c65ac899d133d78dc5e1a78df438ea53067a8a7af5c07dc83bdc19b54041cb18f3f259ac9a089d173c9c560df84539f03575a3a7f29b1c324
SSDEEP 192:3Rx7AFLfv7gjPRpHDG9bHsb+WNn3E0x5ay7a9rCFVyIsnAUgE:3Rx7uL3MXqBwU0KkaJCzE
TLSH
T10042A32AE910793F9DDBC32AFA627B97D6F5102131902E84E7FC892C15E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd96823a-7ab8-42b7-83b0-ca06e0909d93.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dd96823a-7ab8-42b7-83b0-ca06e0909d93.tmp
Size 11KB
SHA256 7e8b5e47a77d901c46671ca7145b1a8c4f5b109fc26e746310a37c33a8e00be0
MD5 420e38f4e6784ed4032a26e163a0eb9f
SHA1 469110cd43b0cb18f472468854f1ba0c26a52339
SHA512 5801ea9b9d0a52f3c84573845209f801110414ae249b98d8d1e3862f62d8fd7fc4801036b134246f1d37817005c44bb976029d8efca805da75b296f15b6a4919
SSDEEP 192:vRx7AFLBNv7DvAPRp2DG9bHsb+WNnaIaP65ay7a9KCFVyIsnAUgR:vRx7uLBt/6X9BwaJPfkasCzR
TLSH
T10232A529EA10753F9DDBC22AFA627B97D6F5102131D02E84E7FC892C25E76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebc8a276-e645-49fa-9494-4f67c3ad44cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ebc8a276-e645-49fa-9494-4f67c3ad44cc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ea736a30-c3ba-4ba5-81e0-d325e55ac509.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ea736a30-c3ba-4ba5-81e0-d325e55ac509.tmp
Size 6KB
SHA256 18afce5e1ba2f61a97705e5bad630562943941d79af6b10f0359e328dc58972d
MD5 9fb8701bfbf9a1af1b90f18cc8bdefc0
SHA1 e67d2fc6c42558f7c68a4ea01455d17f3d79fd45
SHA512 0164ef7cb6381b6992dd4dab0c434be87516ae01d1aa54c706fcbf4900b76a04c9ad65cad999ab4bd1b2c5c635b940de967051e220bca57398653c7da387afdc
SSDEEP 192:3t0xJPz8/Ck3xtiU2tpPPvI4Q87eJNSuCml:3tolhk3zAPQF84NSuCml
TLSH
T121D13C71A86C5DBB8CF6E591714329078EA87157BA18BE94BADA0F0C01EB4EC1743637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8f31944-b791-40b6-8409-30da158c7502.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f8f31944-b791-40b6-8409-30da158c7502.tmp
Size 5KB
SHA256 0a12afda696c252f699a9b0aff959ad541ad7d2c0a1a58d99a0ec718efacdb14
MD5 ce79142d620fb17ed6f633257f9882fa
SHA1 d743692ef2f2302230efc534ac80a44dba7eb871
SHA512 888ebfef09391ed81680e098cbd2af2391c1ec4db0ac6d097f55d9e745f8041228cf2162feb6bb74b2e27f5f6fd7b95cb22320204e2d7b7135c1986dc6af26a7
SSDEEP 96:3bJ0d+qJw6eq8Em6eifKcIzSNoxvSl8h4otop5tASDJB6OGGfvQH4QplJNSRNC3v:3t0xJPz8/Ck3xtiU2tpPPvI4QplJNSuB
TLSH
T1CAC11A71E85D6DBB8CF6E495B1032D07CEA8615BBA24BE54FAD90E0C01E74EC1783623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download