hxxps://secure-web[.]cisco[.]com/1UG7I1L6aJ9SMixiAZrDOdjjdsBB3Qg2WwOKTgt7byCj6yMeerHdWU96O_ICZvKvw1Tz6chFlboFk3MHPJ2DPZt5jLmu1J9KPPfPy8R6OC8L94Q6xrUbIv1tb9JZJdalWcts7XPv1etwnuoKWPP166FZNfgQ7ZFEA1UAr4EGPwtkUH0B4V4Elxb3m-xZ-RKO0uaHK2ct8cxhCXoGZtI73HvZTdxO6nOfH26mEInMnyjeyecsqVvQrHbwUyVkAVzDeJDULEohzU9blC-B3JuXQrztBF92HXyu_W4oB_q_4LWopxO453uzU-OwAHTatgLCuMBgkyBjHZbDyIuhGO7hD6QYCc3AG_5uEjaWsenhfib14ksYB9K5clLLF8kFrP52D/https[:]/dy6xxh04[.]na2[.]hubspotlinksfree[.]com/Ctc/Z0+113/dy6xXH04/VWjCvG2WBnwHW3b_HfR44-5QxW6L2xF55Wl5QZN3cFw6z3m2nnW8wLKSR6lZ3lbW7k3_PM4MVwn7W1F59_s2SD36FVxcTY-2j8H4mN7yG7K5V7VySW52p6PJ4Q056mW4Dm7zt33SFkQW7pXjK64yGq_ZW5PfyyB82KYxZW6WJcdx7wbVv2W4lv8zD56Dd3rW69CWm44Nlg3vW6Y3SDY6BSMp5W8z9lgd812XKDW6yF-D15Zwg9DV-395g2ltpzqW2lHrl_1_kzzpW71PYKN6SkgB7W7yLHvL3qd6lnW39jYV62SZGcZW9kVVKC1cplDzW7zYyRj2L5c2KW8jT_rV5ZYlYnW8Q-1XJ5Nyw_fW1bnpGq2YYdzGW56SSMy4WCcCpVSrHLc7qLF56N8gvwH0h10xJW74nsx_6wfkpPf1hvl5P04

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://secure-web.cisco.com/1UG7I1L6aJ9SMixiAZrDOdjjdsBB3Qg2WwOKTgt7byCj6yMeerHdWU96O_ICZvKvw1Tz6chFlboFk3MHPJ2DPZt5jLmu1J9KPPfPy8R6OC8L94Q6xrUbIv1tb9JZJdalWcts7XPv1etwnuoKWPP166FZNfgQ7ZFEA1UAr4EGPwtkUH0B4V4Elxb3m-xZ-RKO0uaHK2ct8cxhCXoGZtI73HvZTdxO6nOfH26mEInMnyjeyecsqVvQrHbwUyVkAVzDeJDULEohzU9blC-B3JuXQrztBF92HXyu_W4oB_q_4LWopxO453uzU-OwAHTatgLCuMBgkyBjHZbDyIuhGO7hD6QYCc3AG_5uEjaWsenhfib14ksYB9K5clLLF8kFrP52D/https:/dy6xxh04.na2.hubspotlinksfree.com/Ctc/Z0+113/dy6xXH04/VWjCvG2WBnwHW3b_HfR44-5QxW6L2xF55Wl5QZN3cFw6z3m2nnW8wLKSR6lZ3lbW7k3_PM4MVwn7W1F59_s2SD36FVxcTY-2j8H4mN7yG7K5V7VySW52p6PJ4Q056mW4Dm7zt33SFkQW7pXjK64yGq_ZW5PfyyB82KYxZW6WJcdx7wbVv2W4lv8zD56Dd3rW69CWm44Nlg3vW6Y3SDY6BSMp5W8z9lgd812XKDW6yF-D15Zwg9DV-395g2ltpzqW2lHrl_1_kzzpW71PYKN6SkgB7W7yLHvL3qd6lnW39jYV62SZGcZW9kVVKC1cplDzW7zYyRj2L5c2KW8jT_rV5ZYlYnW8Q-1XJ5Nyw_fW1bnpGq2YYdzGW56SSMy4WCcCpVSrHLc7qLF56N8gvwH0h10xJW74nsx_6wfkpPf1hvl5P04
Sample261020-tk3t5assdx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
1060	chrome.exe
1060	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4320	3128	chrome.exe	85
PID 3128 wrote to memory of 4944	3128	chrome.exe	86
PID 3128 wrote to memory of 4944	3128	chrome.exe	86
PID 3128 wrote to memory of 4540	3128	chrome.exe	87
PID 3128 wrote to memory of 3684	3128	chrome.exe	88
PID 3128 wrote to memory of 3684	3128	chrome.exe	88
PID 3128 wrote to memory of 1728	3128	chrome.exe	91
PID 3128 wrote to memory of 1728	3128	chrome.exe	91
PID 3128 wrote to memory of 1040	3128	chrome.exe	90
PID 3128 wrote to memory of 1040	3128	chrome.exe	90
PID 3128 wrote to memory of 3504	3128	chrome.exe	92
PID 3128 wrote to memory of 3504	3128	chrome.exe	92
PID 3128 wrote to memory of 5100	3128	chrome.exe	95
PID 3128 wrote to memory of 2128	3128	chrome.exe	103
PID 3128 wrote to memory of 544	3128	chrome.exe	104
PID 3128 wrote to memory of 3020	3128	chrome.exe	105
PID 3128 wrote to memory of 1060	3128	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://secure-web.cisco.com/1UG7I1L6aJ9SMixiAZrDOdjjdsBB3Qg2WwOKTgt7byCj6yMeerHdWU96O_ICZvKvw1Tz6chFlboFk3MHPJ2DPZt5jLmu1J9KPPfPy8R6OC8L94Q6xrUbIv1tb9JZJdalWcts7XPv1etwnuoKWPP166FZNfgQ7ZFEA1UAr4EGPwtkUH0B4V4Elxb3m-xZ-RKO0uaHK2ct8cxhCXoGZtI73HvZTdxO6nOfH26mEInMnyjeyecsqVvQrHbwUyVkAVzDeJDULEohzU9blC-B3JuXQrztBF92HXyu_W4oB_q_4LWopxO453uzU-OwAHTatgLCuMBgkyBjHZbDyIuhGO7hD6QYCc3AG_5uEjaWsenhfib14ksYB9K5clLLF8kFrP52D/https:/dy6xxh04.na2.hubspotlinksfree.com/Ctc/Z0+113/dy6xXH04/VWjCvG2WBnwHW3b_HfR44-5QxW6L2xF55Wl5QZN3cFw6z3m2nnW8wLKSR6lZ3lbW7k3_PM4MVwn7W1F59_s2SD36FVxcTY-2j8H4mN7yG7K5V7VySW52p6PJ4Q056mW4Dm7zt33SFkQW7pXjK64yGq_ZW5PfyyB82KYxZW6WJcdx7wbVv2W4lv8zD56Dd3rW69CWm44Nlg3vW6Y3SDY6BSMp5W8z9lgd812XKDW6yF-D15Zwg9DV-395g2ltpzqW2lHrl_1_kzzpW71PYKN6SkgB7W7yLHvL3qd6lnW39jYV62SZGcZW9kVVKC1cplDzW7zYyRj2L5c2KW8jT_rV5ZYlYnW8Q-1XJ5Nyw_fW1bnpGq2YYdzGW56SSMy4WCcCpVSrHLc7qLF56N8gvwH0h10xJW74nsx_6wfkpPf1hvl5P04
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc89e7c728,0x7ffc89e7c734,0x7ffc89e7c740
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,1107253843043106877,9139684080766404577,262144 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1552,i,12702350144901280714,11051653933058221207,524288 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,11030826398353589349,6806854474865338230,524288 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,14572341653432630504,3226733157300774832,2097152 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,11161646163569010381,9647375671198672228,2097152 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,1498115896137762318,11871719246115357283,2097152 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,8349426472508823751,9156228322065614179,524288 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,9514822094709917316,11593228489361067800,524288 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,7783558147051338887,6152193647356601124,524288 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,3651660310167662694,9464324147552377548,524288 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5556,i,17688302139053607763,17615355244093678240,262144 --field-trial-handle=1996,i,15162039797782363553,2858055362743853456,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

417dd2ce-7b9b-4ef2-a0e7-0e43a85de802.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\417dd2ce-7b9b-4ef2-a0e7-0e43a85de802.tmp
Size 131KB
SHA256 a9b3ca92d5f4fe1fa191c6151ff5660753be714f03b14f2d428ab9bd5328ea30
MD5 d28f53825e4a56f9dc6ae3b692bf5645
SHA1 a286138f783b90cf1adf04dbada257f2400f77af
SHA512 45c4ce3edf75cb92345a60b2f1d0007b5592bc7e2ce4c9b3c2e8495e94dd5c88f9585f60c7c3b2cbb953425ac3aaaf7ee0ec4198f8ce8d8d174e8a9c6ea27467
SSDEEP 3072:x+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:x+hFD+7t56OD9ZfSApprr
TLSH
T1FCD30232AA95D8BBC9BD6541F157A300DD72A8ED41DE2A09444A5FCEE09FD4C03B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5783eb43-3985-41bb-95ec-0454167a0dd7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5783eb43-3985-41bb-95ec-0454167a0dd7.tmp
Size 130KB
SHA256 8167009afdde864ff01b2eb823a52675efefd1c0a7f1cee3e0829cdb9281138b
MD5 ed0356878a77962089b24b52c0e4f9e0
SHA1 e576438dd2cedf53ba13695a89da335fc74e61ca
SHA512 4933374aeac38c3555d231e370715d09fe45d03daa99c538cf5c622e83b2516d0d35bd8f8f3598b805636174cb301f2d09dcc61ea388adf42753bb22e5bf4dd2
SSDEEP 3072:g+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:g+hFD+7t56OD9ZfSApprr
TLSH
T153D31232AA95D9BBC9BC6541B157A300DE76ACED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24cbd314-79dd-4f9b-923f-c9053b038580.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24cbd314-79dd-4f9b-923f-c9053b038580.tmp
Size 13KB
SHA256 7e7c2eac6895b2fef627b548d863093a2f18c5a6110879a59a7253054f7c4e30
MD5 e9f4d2137dee7184a374c2d2195bac16
SHA1 2b62ab15d0266a99ef8b28326d674fa460778836
SHA512 f1378f5e40cc736c5298d1f34e4e8f5ad8c945e02e1dab794ed3859a1bea22ea328aff30c4f9da7a751eaf1f1c64a6a81d8100f0c0dfc68922ad40fcfec58aa6
SSDEEP 192:NR6WRQaFBSv7VNDp3PRpnQX9QHsb+WNnqx+/je8fbol7+VyIsnAUgE:NR6WHB+ZxJXGWw8eeKy2E
TLSH
T1B452C52DB910797F9CD7D22AF966BB17E7F1102220902E84E6FD893C15E7ACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47de765f-84b2-4098-8840-ac9a40f6e264.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\47de765f-84b2-4098-8840-ac9a40f6e264.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6afe96eb-5045-4a26-a904-abd9a3d6e56c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6afe96eb-5045-4a26-a904-abd9a3d6e56c.tmp
Size 414B
SHA256 a9ebd31e8801c79cab9725670c76211912b488d027adf2e4309348f1ad3f1aa2
MD5 faccd412410f3488e3e9e77df1bb3e48
SHA1 9afe424d4ce8ad677f3e226bcf026d2231452efb
SHA512 39dbd8ac79a4196b6fd9b85b8cfdec10d83c6b4a6bb14c160276ad36fd20eb10360cd97333219c83e780db33341df9772dabf497677a53bb253c8fa9a39c434b
TLSH
T1E0E02BA6E822EC3B19FC075D65644746F75053577681490B3A3CC30D4FB0636468689C
MD5 SHA1 SHA512 TLSH

Submit Download

2d1351bb-8d6f-4448-8ffa-3608de6b4f6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2d1351bb-8d6f-4448-8ffa-3608de6b4f6e.tmp
Size 1KB
SHA256 5dc941295997e6974b1b0e214bf8131eae6a4e9d243addaf9a5adbff915f7bd8
MD5 30c41c3c9325a81ee915969b2e12b2c4
SHA1 126bab9eb5f514e32968cc121d0f7343d20e1793
SHA512 e093b0622fc7269380d1d5eda04ed7dc32600c94e5c9e62efcf96bef3e946cc16dc95ad50b6341694fe713945d35f3da2454417fa59f57eb9ae159eda9bc659c
TLSH
T16F418BF793B4957E8A1192E4EA156F1FCE6A0524131C7CA688E46E1B83E2972E10178F
MD5 SHA1 SHA512 TLSH

Submit Download

ce3ac783-2ef4-4a0c-9bea-7fa09854741e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ce3ac783-2ef4-4a0c-9bea-7fa09854741e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 58cd946dde7f20e090158d213fc41430defed3e59a7936a39f39700d80504ec4
MD5 41357f9fab0184ef14b3037980705790
SHA1 f86e8b3bd8711ffd98be2743018425599b821560
SHA512 f560914fe8a4233bf29e7c62a04c17a7fd4737a0ab8a83272e684b45581353d3902a4e9c9593d3bb91972ec466447539c8f77ca36b6ed95bbc50ef99026658cc
TLSH
T141B0124480429301C09203F8315164C83698DF20AA05134153F41D51C836361801B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e05300a9283b7bf8184600ae5724d2b879af9258645b1e97627bca5568887ef4
MD5 d76504cb60ce53ee1a039440548d2511
SHA1 d99a86888e00af49c8fa465f7643a188e7034de3
SHA512 457fe444554b260b169e64cc1a7dea9a3d6c894f2fc27f5b75c6dfd8fb06193786746607d3d3910338a433b8bdec235e22e7179d84a6b8f4649f458e845b6ef9
TLSH
T11BB02222C0022302C00203B02C808AC8B020FF20CA03B303A3E00EA2CC3A3A00030820
MD5 SHA1 SHA512 TLSH

Submit Download

cdbc70cc-9b45-4e46-a589-ff3676e3f6ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdbc70cc-9b45-4e46-a589-ff3676e3f6ee.tmp
Size 14KB
SHA256 b494e61f07372ec9c7e51cecb31e35f7b1764c9454464712d269b67764c84218
MD5 779b83eba2269d00b677242dea1e1e0d
SHA1 4c0eeebf4312622db708a61e247a5a2a742d6b5e
SHA512 a0dafae9dea8b578fc1e281968512282b6ec5965118828fb163155216d9e94f3cdfc5a61b7a4f5636d6bb5bcc89c2c71d8f6810856f0ed434ef44469c50837c0
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3Htb5w9:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pY
TLSH
T1E562F867AC4C9E3B0FD4D649CC177A4FEDB4025621AE886482FB982503E4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eba5380c-29f4-4bb6-aac5-8d3157965da7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eba5380c-29f4-4bb6-aac5-8d3157965da7.tmp
Size 12KB
SHA256 913031dfa2b01ae3625cd75ef567891513c8e803d3e55adf773f2a27893989c9
MD5 ad5b87497932c87a92364585be19aab6
SHA1 9100b45f6eaef63d1962a3b1f614dd20915d6a8d
SHA512 4cfeb490f570c6cc4e2b8a8a13ef1e5273e030f6e0567a1a5e6eacc5242d6ff29f611abad8991dd0e6df34dd45f0e51b6ea787905b0e82786ced4a1063226f83
SSDEEP 192:NR6WRQaFBZv7VNDpAPRp2QX9QHsb+WNnqx+jn2lfbolh+VyIsnAUge:NR6WHB5ZxUXpWw8m2Ju2e
TLSH
T1CE42A42DBA10B97F9CD7D22AF9667B17D7F1102120942E84E6FD883C14E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 ee4b0935e306fe4bddce462871a2393245f9b96cfb601a5726c644af28b42c46
MD5 93613c31e4a74009a80768d7df4fcc19
SHA1 775a51548ce0eba9c8d8455b5e8d6bae464c9dc0
SHA512 594eef8fbed60e3d6a98d92d44d5637b113665ea76cd3cdb8d2ed97bad6de8e256755a903d32bf8baf52e2a7ab77d470a21f1a0c20450cdfe796abf745442ce9
SSDEEP 3072:e+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:e+hFD+7t56OD9ZfSApprr
TLSH
T1C0D30232AA95D8BB89BD6541F157A300CD72A8ED41DE3A0944465FCEE09FD4C03B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afe23d8f-6505-4950-8d2f-84be87bcd1bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\afe23d8f-6505-4950-8d2f-84be87bcd1bc.tmp
Size 131KB
SHA256 6324ba4eddb814d35fea0dc6e4ee0e19e65e2c48c587c4562af4cd9152b546b0
MD5 50da4da946e7f0e4493449e3ad8f8177
SHA1 de86c1fe3e0e00776766a8749f70fa09d1a5d2c8
SHA512 3cb459d7654e66a0f2f1809bddef362456e96a6275715539ec6a9dbad0fa84589c8f9285988976e6df02ef3bef45044392b63f563762f1a3ac7b353c2781af10
SSDEEP 3072:F+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:F+hFD+7t56OD9ZfSApprr
TLSH
T139D31232AA95D8BBC9FD6541F147A304DD76A8ED45DE2A0984465F8EA09FC4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download