b5d258b46e44be9aba6e9da5d7dc568c430ff3a3c3a13bd250e17387d2e81c20

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0 (47).eml
Size 372KB
Sample261014-pptpssc14v
SHA256 b5d258b46e44be9aba6e9da5d7dc568c430ff3a3c3a13bd250e17387d2e81c20
MD5 7d25cd235b7d38666075e95c0a3ee5a2
SHA1 40de348c93f06d7b91fe237805dd1628685d448d
SHA512 5e96787683333b170cd31a29cf76a15fcca34b3960acdd6a6fd7eeb2372737327a70b5f3c19145fc6f7a3d6a854103ade7d787f353f414d9c366e7a1741d3280
SSDEEP 6144:tbWW9zs4dV2elmRIyjvp+j7DoV3Hufg7UMKgY4ucVVUruVc4Risa92Zq:tbWW9zIelmBGDE3AbbgYo3Foslg
TLSH
T1D8846A10D7B28F7E44970AEF480332D4657CA2F183ADD5B771ABEF6AB065CE2C609125
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
736	chrome.exe
736	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4848	OUTLOOK.EXE
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of SetWindowsHookEx 41 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
1188	OpenWith.exe
4848	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2716	1188	OpenWith.exe	96
PID 2716 wrote to memory of 2404	2716	chrome.exe	98
PID 2716 wrote to memory of 4768	2716	chrome.exe	100
PID 2716 wrote to memory of 4768	2716	chrome.exe	100
PID 2716 wrote to memory of 1280	2716	chrome.exe	101
PID 2716 wrote to memory of 1796	2716	chrome.exe	102
PID 2716 wrote to memory of 1796	2716	chrome.exe	102
PID 2716 wrote to memory of 3480	2716	chrome.exe	104
PID 2716 wrote to memory of 4456	2716	chrome.exe	105
PID 2716 wrote to memory of 3480	2716	chrome.exe	104
PID 2716 wrote to memory of 4456	2716	chrome.exe	105
PID 2716 wrote to memory of 2344	2716	chrome.exe	106
PID 2716 wrote to memory of 2344	2716	chrome.exe	106
PID 2716 wrote to memory of 1512	2716	chrome.exe	107
PID 2716 wrote to memory of 1512	2716	chrome.exe	107
PID 2716 wrote to memory of 2504	2716	chrome.exe	108
PID 2716 wrote to memory of 1156	2716	chrome.exe	112
PID 2716 wrote to memory of 2292	2716	chrome.exe	113
PID 2716 wrote to memory of 2384	2716	chrome.exe	114
PID 2716 wrote to memory of 736	2716	chrome.exe	115

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 (47).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument mailto:[email protected]
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0456c728,0x7ffa0456c734,0x7ffa0456c740
    3⤵
    PID:2404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,818901682978766566,2522753552472306195,262144 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,4760254061406149926,10129246942479744333,524288 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2468,i,15469924482487579296,9449257590302484705,524288 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,16923424235634498367,5889341831979594897,2097152 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,11127958208131928747,6934436964976818806,2097152 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,8855958594843011917,4997391285989733103,2097152 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
    3⤵
    PID:2344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,6496876611114558827,4899426689287700601,2097152 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,11438474212206467700,2496672502465821434,524288 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,5651638300505690724,1490681386834182022,524288 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:1156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,10165724492758136156,14177020857112290057,524288 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:2292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,15305682511227511591,8977449545002846542,524288 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:2384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=864,i,14324724679346494781,15668183484366600447,262144 --field-trial-handle=1980,i,10557503932198939087,14252739827424848665,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29b31b5d-3cc6-4409-ad1c-f59cb36e5c10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\29b31b5d-3cc6-4409-ad1c-f59cb36e5c10.tmp
Size 267KB
SHA256 dd170a2232fce2b9b7bdd3495418dd4a724f7048eeb921edad1b262962603004
MD5 5e13b1345d4b0953cf5f6de1a124763b
SHA1 223551de193e6feb2bbe432233a45e91c3afae03
SHA512 cc851654057a6a7176b900bbb4b71bc549e315693465f77c3c6797af773fc423115472e46a7ed374b35d60400be71941786ac41ce8d510634609476397a23d13
SSDEEP 6144:l/tUZvxYkhkW9JbYEv+hFD+7t56OD9ZfSApprv:l/ebhR7bYEvyFSXD9ZfS4N
TLSH
T119441291FD19DC6BC6FD509176AAB304DF72A8DD04CA288A85F50ECB526F5CC07D3A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

445ca170-a4b3-4c83-9ba5-84669d73487f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\445ca170-a4b3-4c83-9ba5-84669d73487f.tmp
Size 331KB
SHA256 9800e043084c6dcc61e9464a1d592c33a70fe91ccefb23f8207a6bffdd9b14a5
MD5 90b24c79537181233fc40ea130b9457f
SHA1 384d19a8e9be5496912be2024bb1e9390caebb7e
SHA512 dcf48bbe7660d9854cd686eab123452cca6e57d038e84b65f638f2e6886e96f847050dfec5c6b2a8b26dc8089cecb0f0e0d7592b8baa9a02f5f9896c02b9921b
SSDEEP 6144:ZTf/CMyi/tUZvxYkhkW9JbYEv+hFD+7t56OD9ZfSApprv:ZF/ebhR7bYEvyFSXD9ZfS4N
TLSH
T1157422B1FD19D85BC9FD9140BAA67204EF71A8DE48CA68CB85F419C7526F1CC0BD3521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f94c201-0a40-4851-abf2-04bef6ff963a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5f94c201-0a40-4851-abf2-04bef6ff963a.tmp
Size 267KB
SHA256 b0a7923f4538816374fd976797000ad7750f63105ebb57cf8d6a581745982e3a
MD5 3826dce9826400d29fdc04209b122209
SHA1 1a85d8e6a125e17f5655c57db22b109b6cea7de4
SHA512 9ad2a38556abeae1a5abf43410aa302c9050b7ff98a4481b4d9daad76c4a7eb480a84805e6c297b7cdf3fd5d55452a6f4b96a9d955f09c8845d6fbf8654ff369
SSDEEP 6144:y/tUZvxYkhkW9JbYEv+hFD+7t56OD9ZfSApprv:y/ebhR7bYEvyFSXD9ZfS4N
TLSH
T1AA441291FD19DC6BC6FD509176AAB304DF72A8DD04CA288A85F50ECB526F5CC07D3A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b8c512d-451b-4952-a54a-4badacd3c4c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1b8c512d-451b-4952-a54a-4badacd3c4c8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

268c687a-4e65-403c-953b-17d90c3de220.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\268c687a-4e65-403c-953b-17d90c3de220.tmp
Size 12KB
SHA256 2ab4f944db00dfa09fe333427d0f11faa440399b7ef6304f10214a4a1bc807c2
MD5 5bd7da0d5695570348301e5b8e1242e2
SHA1 3d797df6d921f3245e9214840848e6bcc720b932
SHA512 e829f3c4c05e10cf7244cb2b772de343efd6b4435f2f0c6ea4a4d486df2a3ba9761793c76162e459b3d50fc839592546d8f3541c4b8d2845857ad3bd0f068f31
SSDEEP 192:oRZSMTQC/yv7TpAPRp2V9WHsb+WNnZW0KJleQESVyIsnAUgtaJ:oRZSWevUX6Uwg0Ot8
TLSH
T17342842DEE10753B9CDBD21AED617B53E7F9102624A42E84E6FC893C25E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33b53905-3a3a-45f5-a923-646afda19e0e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33b53905-3a3a-45f5-a923-646afda19e0e.tmp
Size 414B
SHA256 6820fe8e30e715441171d1f1396a3c23ebb15697ff762d510ed573fe61037ab9
MD5 2af7d9d88925d85293de17abda38ff33
SHA1 47945d0ade429c0f6cb0d6657352058c49c1250e
SHA512 bf6df90450e9c08379a460a1bfe90157a65cc0d6baf601f859267e287939262cd047a45b4534b911b0af99cf361bd65fcf42b6e42451a6c0563681cfc7c49ba2
TLSH
T12FE02BA5CA61FD2709FD571914544B81EB5013773F90844F3B3CC1088FB1B3A0586C2C
MD5 SHA1 SHA512 TLSH

Submit Download

3441e324-c214-4cfb-ba05-8e6b085388dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3441e324-c214-4cfb-ba05-8e6b085388dc.tmp
Size 12KB
SHA256 2dd36e820026a62d59467ae3dfe1ababd708b088e94396a7a72a79f3ba5dec63
MD5 53c1aaff9fa194c69d89ceb8b7527752
SHA1 001df4113d28686a43dd2984e74fbf47048cb67e
SHA512 5cf78a51d1f15635360cf53c1710cd889604823a15639ad644398a11d1d79e1c7499194740af74833bf8447f28cc694f1ae5d1a099f75883b03d483badf03d34
SSDEEP 192:oRZSMTQC/uv7TpAPRp2V9WHsb+WNnZW0jJleQELVyIsnAUgraJ:oRZSWKvUX6Uwg0pOe
TLSH
T1FA42842DEE10753B9CDBD21AED617B53E7F9102624A41E84E6FC893C25E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57aef6ec-9de9-41e2-9684-28852f5adf65.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57aef6ec-9de9-41e2-9684-28852f5adf65.tmp
Size 13KB
SHA256 3ebafe940b6f17e816e6e9b7e9f906e4598c4b95a07c55bcff95044cae1e9cfd
MD5 f3ace1fa4238b7bc4b2cee6254435ad0
SHA1 682d3f4c542bd32a2b319e4507527d37739635f5
SHA512 19a134ff7a99f1453a0d1916ed117ca2f4c27420a585a791ff361013c863c047bbb4108c77cc05e94c57413f45f90343aeccda2968a4a0966fa1e70adb9ca010
SSDEEP 192:oRZSpTQC/uv7TpVPRp9V9WHsb+WNnZW0ZJleQEpVyIsnAUgraJ:oRZSdKvzXnUwg0Dqe
TLSH
T11C52A429EE10753B9CDBD61AFD617B53E7F9102624A41E84E6FC893C25E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

702a2a81-62fa-430e-8485-c88b353781e5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\702a2a81-62fa-430e-8485-c88b353781e5.tmp
Size 2KB
SHA256 d874aac55b991e81061a059a4bf8c0906c1690656aa400efeb598973340c7434
MD5 f2c36105d24100dbf9c429b7e9bcb2f7
SHA1 b217b1296286f47409106b77225883d218e204cd
SHA512 b954b1966f4dc891e2359f0c602fb9b58eaf48f48d3b89fe63425fc76a996d07a414147cd11f401a2dffa8181863ffbd0131d762c2c3ad5e3f633ef1b2d36f71
TLSH
T188518DF7D3E4CA6EC91156F4AB257E1FCE290A14121C3C66C8D8AE5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

f1d68c5c-19d0-49da-b575-43a29fd9a51d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f1d68c5c-19d0-49da-b575-43a29fd9a51d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 8810d9f2616d33c8b0d2d01d1dc2540c00682201ecb2f15bece6877f0e89669d
MD5 6c18ac0b66212d553d3ab056eda9b6ac
SHA1 c7c84717dc57870346c7b782922e1ca2897e9679
SHA512 e5861233b3a9e83373f692d26547216cb541aecb057b00be2733abd917e19c44ea9ccc7da902c32d55a9e5ae77a16758814dff839fd4d600f5779ca37ae3d8eb
TLSH
T1C8B0125480415302C10312F4556124983154DF20E605374141F00E55C835261819B064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f33880606fc1cb4a35687bf0379aab1e6d80a363d0f28ca799831e3df79dac26
MD5 985d0bfcc6af0a0c864651d8e9292015
SHA1 9987a044f748b1f8f36806f2763d98b6291e721e
SHA512 ef2e393bfac12d40aec41fedec11d43fcbdf6014c938c9c7df25458a9fe62231b1ca76f69c3a2d7f04afd73b29cb7e7f01736b0a61c9a8e5d2ebe62124ca4621
TLSH
T169B0220AC0022202C00203B03880C0CC3020CF20C3032A2283F02A3AFC2A3A002380A0
MD5 SHA1 SHA512 TLSH

Submit Download

cbc3030e-8815-4a55-8f36-ff0552c6632d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cbc3030e-8815-4a55-8f36-ff0552c6632d.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4940668-e992-440d-addb-63db6eccdaf1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f4940668-e992-440d-addb-63db6eccdaf1.tmp
Size 130KB
SHA256 d93e953ce8bfc4a75112a87d205565deb51c0db2a0f654194a8e5c8a2882b930
MD5 f6111ad7fbb8d63a46c43ad731240ae4
SHA1 bed0d561ded48f53c7dcb8a1259b4ef6dda729f5
SHA512 4ee4b73ca7f591fd50d4f8d2dd55a19c2eb3fc12c82f2847f54f7576463a470692db8170adc09f24295d9998cdd1b993b1b4d0438b5545f78e13d2249e81aa24
SSDEEP 3072:x+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:x+hFD+7t56OD9ZfSApprU
TLSH
T1BBD31232AA90D8BBC9FD6541B197A300DD766CED41EE2A09444A5F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/4848-8-0x00007FFA31630000-0x00007FFA31825000-memory.dmp

Download

memory/4848-62-0x00007FFA31630000-0x00007FFA31825000-memory.dmp

Download

memory/4848-11-0x00007FF9EF020000-0x00007FF9EF030000-memory.dmp

Download

memory/4848-10-0x00007FF9EF020000-0x00007FF9EF030000-memory.dmp

Download

memory/4848-0-0x00007FF9F16B0000-0x00007FF9F16C0000-memory.dmp

Download

memory/4848-9-0x00007FFA31630000-0x00007FFA31825000-memory.dmp

Download

memory/4848-7-0x00007FFA31630000-0x00007FFA31825000-memory.dmp

Download

memory/4848-6-0x00007FF9F16B0000-0x00007FF9F16C0000-memory.dmp

Download

memory/4848-5-0x00007FFA31630000-0x00007FFA31825000-memory.dmp

Download

memory/4848-4-0x00007FF9F16B0000-0x00007FF9F16C0000-memory.dmp

Download

memory/4848-1-0x00007FF9F16B0000-0x00007FF9F16C0000-memory.dmp

Download

memory/4848-2-0x00007FF9F16B0000-0x00007FF9F16C0000-memory.dmp

Download

memory/4848-3-0x00007FFA316CD000-0x00007FFA316CE000-memory.dmp

Download