4ea01cf424fc8eba2c5c7f2f5283d376cfae4897d20b87ac52a1c949207ae2c9

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.1MB
Sample261014-yrpcjayv3n
SHA256 4ea01cf424fc8eba2c5c7f2f5283d376cfae4897d20b87ac52a1c949207ae2c9
MD5 e4cba91b5c0d368989aa175f6f7a3ca2
SHA1 b97b0fc9479f3e4452ed40ca7b6e048ec5639ef9
SHA512 a47ee0e89d64cf2260992b063c4b7cf77ef18d40cc45f973f2137a92c607e356f3534be63987f14ad2e341e654172a9bcb120674580dc6b39a9bdd5739feeee9
SSDEEP 24576:s5PTIyz0e7halRN+4aM0UbKIt3NVcoQufz9:2TIyokhM330Ub5coV
TLSH
T14545197CFB8E84EDF04A8DBD49C893B2BE4CF20925C5299E131C1E7749AB05155EE728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90
PID 3276 set thread context of 1968	3276	Explorer.EXE	90

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\affirming\wrawaineinn	file.exe
File opened for modification	C:\Program Files\AppData\mqoalsaops.dat	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server\inianteiapp.dat	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3776	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
1968	chrome.exe
1968	chrome.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
1968	chrome.exe
1968	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3276	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3940	file.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3276	3940	file.exe	56
PID 1968 wrote to memory of 1172	1968	chrome.exe	91
PID 1968 wrote to memory of 3776	1968	chrome.exe	93
PID 1968 wrote to memory of 260	1968	chrome.exe	94
PID 1968 wrote to memory of 260	1968	chrome.exe	94
PID 1968 wrote to memory of 2488	1968	chrome.exe	95
PID 1968 wrote to memory of 2488	1968	chrome.exe	95
PID 1968 wrote to memory of 3972	1968	chrome.exe	96
PID 1968 wrote to memory of 3972	1968	chrome.exe	96
PID 1968 wrote to memory of 3484	1968	chrome.exe	97
PID 1968 wrote to memory of 3484	1968	chrome.exe	97
PID 1968 wrote to memory of 3264	1968	chrome.exe	98
PID 1968 wrote to memory of 3264	1968	chrome.exe	98
PID 1968 wrote to memory of 1772	1968	chrome.exe	100
PID 1968 wrote to memory of 1772	1968	chrome.exe	100
PID 1968 wrote to memory of 4884	1968	chrome.exe	101
PID 1968 wrote to memory of 4884	1968	chrome.exe	101
PID 1968 wrote to memory of 3444	1968	chrome.exe	102
PID 1968 wrote to memory of 3444	1968	chrome.exe	102
PID 1968 wrote to memory of 5052	1968	chrome.exe	107
PID 1968 wrote to memory of 3336	1968	chrome.exe	113
PID 1968 wrote to memory of 4088	1968	chrome.exe	114
PID 1968 wrote to memory of 848	1968	chrome.exe	115
PID 1968 wrote to memory of 636	1968	chrome.exe	127

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3276
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffecd7ac728,0x7ffecd7ac734,0x7ffecd7ac740
    3⤵
    PID:1172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,8691087468973606572,6378432881011771248,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,16857750699243767730,15622645065091120798,262144 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,15152866446365329569,6415026447511561545,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,13162182527851178366,6898581795843364124,2097152 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,3212149194826402580,3572373260472500143,2097152 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,5126076833290187539,11550702761859993740,2097152 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4264 /prefetch:2
    3⤵
    PID:3264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4532,i,13880910013404961940,11768752493408546418,2097152 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,3516497600456464230,17929526210261822791,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4228 /prefetch:8
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,11116102899966659587,7331144900099632473,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:3444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,515590005138263498,5960027653153257546,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,16015113620586100976,3062369326152914716,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,2883210008830062128,8448759882679634225,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,14048557094866117901,8235069603528939753,524288 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4392,i,5527892834658810945,14204119683566170900,262144 --field-trial-handle=2060,i,2201053046192628671,17728796414998581781,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5712 /prefetch:8
    3⤵
    PID:636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

288d0050-2ad9-46d5-b10e-a4c73639955f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\288d0050-2ad9-46d5-b10e-a4c73639955f.tmp
Size 130KB
SHA256 7e8d2074cd46c64c73611ad91afd5fc6bda8eb7f746853349cacf4fcbef0e300
MD5 850e650e3960e0c5710aead8a00df560
SHA1 30954951f53c705dfd0be4b8111b6890ccc6483e
SHA512 1277eb2d0b8427a881af6dd3f481cebff2264cb8dcdbef740f5e4f127e23560f55bb1482b540ea2e8093181e8207e2c09a436d9419539a0da366b75244f353c7
SSDEEP 3072:wJs+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wS+hFD+7t56OD9ZfSAppr3
TLSH
T17FD31232AA94C8BBC9BD5541F157A300CE626CED45DE7A09444A9F8EE09FC5C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ff8bb29-744c-425a-983b-d57547d83728.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7ff8bb29-744c-425a-983b-d57547d83728.tmp
Size 267KB
SHA256 53533d6440a8fd038a549c48b0b05717988c7f0c2b0d85d4e06ddebc392616d5
MD5 4733a38579e02ccec145aae1992a9db1
SHA1 49d3f7426a78e9f7dde715bc1e62b690d4814b00
SHA512 2d395b8c30073cac54d298624b42f49b595c6a3ce2224dc096d5590d54b3cc090bcce9a2f5e46714b9a08b31280b83cb527780334b336a6cbea5f1af7ec67987
SSDEEP 6144:UjG6x0ogEbPaLM8k1du2FgnPH++hFD+7t56OD9ZfSApprT:Ax0pWaw8VQSPH+yFSXD9ZfS4Z
TLSH
T11C441251D7A08CB795789109A6BF2A04CF9616E891D76B098488DF8ED01EDCF03BBD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02830ae1-7b63-436b-b96c-dc2e9ca26ddf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\02830ae1-7b63-436b-b96c-dc2e9ca26ddf.tmp
Size 414B
SHA256 54d500a736a525911a3593761fe6634b136dc76576674187becc03ba8c0a26d4
MD5 f21ed3c5ea65e66fe459653fa7860362
SHA1 1169b267fec062b74ad91335207cd37f5d69a014
SHA512 7f418ced67ce2376f9ca5d164e4ac1c72908d51beb5df8e9e94b57eb80d5d7adbaea6e55086a44f993f79a61730d4a4399e97434c071900d1c85ba2431c80c37
TLSH
T15FE02BB9CC60AC3718F9076954A01B86E76113672A51850BBB3D820C8FB157B428695C
MD5 SHA1 SHA512 TLSH

Submit Download

66ffe049-3f29-4a40-a3a8-56796713f89d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\66ffe049-3f29-4a40-a3a8-56796713f89d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

13be03a2-fbe6-4712-be1e-cfbe8478f58d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\13be03a2-fbe6-4712-be1e-cfbe8478f58d.tmp
Size 2KB
SHA256 779b294e94196a42d0a7e6948584e37fa14cc787654e6ea3b6b5e466f0523b59
MD5 cb6d80481d8191744f23225565e32dbb
SHA1 b62d0270691c82e789ddcbaaa7e342f3b2511209
SHA512 93b6ef4e394baef7d7d702d3f18a9b4894408d745e78cd6c69a4598ee55950451819ca8cf8558aae08f35c65a8b44928d8c572ec5717c2dce9582e2cc632f3af
TLSH
T181519EF7C7E4857D991156F4AB217E1FCE3D0A18132C3C6688D8AE5B53E2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

a4195fd0-2226-44f2-a7fd-a8bb9b4fabe9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a4195fd0-2226-44f2-a7fd-a8bb9b4fabe9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7be82b52d6cb6134566a7ade718db87f3a9d7de77c6ec770de3bd55fab3c082c
MD5 8a1c3ac5effedb0fb1266bf2fdd9f795
SHA1 36079a1325c53967cff10606ccd7baa612dccef2
SHA512 1ecaab70749038b8aa777ff4671e77865c2fb9d64446abac6ac327565716f3e8f84f208aa1fe737b35993681bb788dfd011c163a101ab1de879d7e4f82671ad1
SSDEEP 192:gRPdFMxzKZ7nQR1v7VJpAPRp2B9fHsb+WNnQH0cQYWjG/kwIzVyIsnAUgtaJ:gRPvADFvUXGhwE0c1Wy/q8
TLSH
T126429129FA10363B9CEBD32AFA617753D7F6102225841E80EAFCC93C25DB5D9221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 5edefd03508378f0bdf0ad9b06f2b43fc362af9faaadd9d9e63ad70a4452c99f
MD5 1e55e9c1edeb94713b5545a2f4da62ce
SHA1 1ec81a96081e66f38941e9819e53030cbe97322d
SHA512 4af286c52aa08eb94aa9f99e6715a5cd58698ef0f98ea5fdfaecea0a6af1f38377aa0001bd8ae8789bc41c6c9c0d1ba18ff50bd8449a55292804003bce8c45be
TLSH
T1E2B0120480816312C44203B011B058C8356CAF10B605130141F00E01C83526281DB095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4a67c2d9db0ac172146b9eb6d3f44c9a47f7736a78ca9ca1fd4b7e1c2e2a96f5
MD5 84494b703fcecf7a45724defc739db6d
SHA1 05e430cb273d9352e0431c0bcd82d19624948297
SHA512 a93e043e7754ef4aaec9a1c39aae1107f41235c62e62863b666a7192ab05b2d6f1d29bce6f708a7307302434e15e83c4f3918022f09e7b010f3bb34dd5c0a4c7
TLSH
T1F1B01213C1839131C41903741D6CC5AC7208FF10C705032371F417029C352710918150
MD5 SHA1 SHA512 TLSH

Submit Download

a1ce4796-f3b4-4db1-b34c-b7a4db21c724.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1ce4796-f3b4-4db1-b34c-b7a4db21c724.tmp
Size 12KB
SHA256 ada3eaf92b575b855270b95d2dd107a5a9b2d490b7e27d3871103cbd9f805faf
MD5 492a20768ebf8470aa1539a537a08379
SHA1 7428b67633a67a994fc1943214709a738535410a
SHA512 271e4b45b26372fa5b54dc6758473f1f27d8461fb87702da781a6ee4d1d5844b5a826e9a88f97198503de303166e7b05da7d39ef7719af24d917f3c01b7694ff
SSDEEP 192:gRPdFfxzKZ7nQR1v7VJpAPRp2B9fHsb+WNnQH0cxYWjG/kwIOVyIsnAUgraJ:gRPvFDFvUXGhwE0cKWy/Ne
TLSH
T1D442A32DFA10763B9CDBD22AFA617B53D7F5102225941E80EAFCC93C25DB5D9221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a27f443b-d40c-4fc8-a33a-814083bc7dc0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a27f443b-d40c-4fc8-a33a-814083bc7dc0.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdb1925e-2791-4c5d-ae52-cc615e79d25d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cdb1925e-2791-4c5d-ae52-cc615e79d25d.tmp
Size 267KB
SHA256 c06e3d65f9394bcbe9f6f11c1dedbd0850ce1646e2e7f0a68bd231770dbeb53c
MD5 bc4f31a407d49ee994e1c5b7b1f380dc
SHA1 70bf3d36153e3e3cc580419ea9801bbe7690be1c
SHA512 7ce5d96893e38b163929513e188d5a59b08e2c6063582469e3fcfee2e8b79b8fae16dd392d0b808a4de5f632e5f31ec6709c281027431758729c30e5787a4fba
SSDEEP 6144:1jG6x0ogEbPaLM8k1du2FgnPH++hFD+7t56OD9ZfSApprT:zx0pWaw8VQSPH+yFSXD9ZfS4Z
TLSH
T167441251D7A08CB795789109A6BF2A04CF9616E891D76B098488DF8ED01EDCF03BBD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f074b0c6-4225-4e26-8840-28d839dba285.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f074b0c6-4225-4e26-8840-28d839dba285.tmp
Size 268KB
SHA256 88b11cbcb4781915e3635dca0a71d3ae91f4ad8b276a82b0c058368ee2d43d5c
MD5 681ab66cba400c02afb476196dc59995
SHA1 c9d9ad291ba93d05f948a40f4e4a1b676d02abe1
SHA512 c444a93bf55b4a0cbd3c4c495efad81173cd63649192a41c511d26e01eeb0f69a42dc494c2e7e3cdaca7aeb7ccc16a3345c4959175b47da47f7ba4fecdaae769
SSDEEP 6144:1JYG6x0ogEbPaLM8k1du2FgnPH++hFD+7t56OD9ZfSApprT:Ax0pWaw8VQSPH+yFSXD9ZfS4Z
TLSH
T1C8441261D6908CB79578D009956B3A04CFE667F981D66F098488EF8ED01EDCE07BBC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-137-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-120-0x00007FFEC85F2000-0x00007FFEC85F3000-memory.dmp

Download

memory/3276-143-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-22-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-21-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-32-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-20-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-19-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-18-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-17-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-16-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-15-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-14-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-11-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-10-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-9-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-24-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-25-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-47-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-26-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-28-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-29-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-94-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-27-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-8-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-0-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-118-0x0000000002C00000-0x0000000002C10000-memory.dmp

Download

memory/3276-117-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-116-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-119-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-144-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-121-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-123-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-126-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-125-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-124-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-122-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-128-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-127-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-129-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-130-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-131-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-145-0x00007FFEC85F2000-0x00007FFEC85F3000-memory.dmp

Download

memory/3276-140-0x0000000002C00000-0x0000000002C10000-memory.dmp

Download

memory/3276-139-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-138-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-2-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-136-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-135-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-134-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-133-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-141-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-132-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-31-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-23-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-142-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-147-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-146-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-148-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-149-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-150-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-1-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-3-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-4-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-5-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-200-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-201-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-202-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-203-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-205-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-204-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-207-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-209-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-208-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-206-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-210-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-211-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-212-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-213-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-216-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-218-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-217-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-215-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-220-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-219-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-214-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-221-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-222-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-223-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-225-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-224-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-226-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-7-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-6-0x00000000033D0000-0x000000000346F000-memory.dmp

Download

memory/3276-251-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-250-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-249-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-252-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/3276-253-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-259-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-258-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-260-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-268-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-262-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-269-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download

memory/3276-274-0x00007FFEC8550000-0x00007FFEC8657000-memory.dmp

Download