f768ff1b70aad0810715bec8935082f8845988722be2ffa991d94a5f880bb20f

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.1MB
Sample261102-dd3msass4p
SHA256 f768ff1b70aad0810715bec8935082f8845988722be2ffa991d94a5f880bb20f
MD5 2fff0b546d537287fe9abb0074a9222c
SHA1 3a857b783a04ce483675da0613a28950d573a676
SHA512 02116ac2ff137acfe3c1e1752426dad2f12fa99e43946a5342b8c3e56eeeab895e92c2779c735a23c1d9fcc621641f9852303d8d0922fa2989cd8fdba486fa08
SSDEEP 12288:jhnvypF6zKGKEsPWdal/WooWFhHraUsARHfDxGTkjaZpk+IBkhhMhSWaZeF+GkY:wpFY4Wdl0Jeq5fQK+Skh+hFF+GkY
TLSH
T1FD4547F0F3810DFDFD3886378657A928911239DE1ED13AAA475C134F0A26E91BAF560D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84
PID 3276 set thread context of 1688	3276	Explorer.EXE	84

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\draughtsman\uierlyauws.inf	Setup.exe
File opened for modification	C:\Program Files (x86)\implementer\beiashieng.dat	Setup.exe
File opened for modification	C:\Program Files\Logi\ishiaock.txt	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2732	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
1688	chrome.exe
1688	chrome.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3276	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4652	Setup.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3276	4652	Setup.exe	56
PID 4652 wrote to memory of 3276	4652	Setup.exe	56
PID 4652 wrote to memory of 3276	4652	Setup.exe	56
PID 4652 wrote to memory of 3276	4652	Setup.exe	56
PID 4652 wrote to memory of 3276	4652	Setup.exe	56
PID 1688 wrote to memory of 5692	1688	chrome.exe	85
PID 1688 wrote to memory of 2732	1688	chrome.exe	86
PID 1688 wrote to memory of 3560	1688	chrome.exe	87
PID 1688 wrote to memory of 3560	1688	chrome.exe	87
PID 1688 wrote to memory of 5700	1688	chrome.exe	88
PID 1688 wrote to memory of 5700	1688	chrome.exe	88
PID 1688 wrote to memory of 1396	1688	chrome.exe	90
PID 1688 wrote to memory of 1396	1688	chrome.exe	90
PID 1688 wrote to memory of 2436	1688	chrome.exe	91
PID 1688 wrote to memory of 2436	1688	chrome.exe	91
PID 1688 wrote to memory of 452	1688	chrome.exe	92
PID 1688 wrote to memory of 452	1688	chrome.exe	92
PID 1688 wrote to memory of 5360	1688	chrome.exe	93
PID 1688 wrote to memory of 5360	1688	chrome.exe	93
PID 1688 wrote to memory of 4964	1688	chrome.exe	98
PID 1688 wrote to memory of 3972	1688	chrome.exe	108
PID 1688 wrote to memory of 3484	1688	chrome.exe	109
PID 1688 wrote to memory of 952	1688	chrome.exe	110
PID 1688 wrote to memory of 4236	1688	chrome.exe	112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3276
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa3a00c728,0x7ffa3a00c734,0x7ffa3a00c740
    3⤵
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,3681849174978354700,9344239094617611662,524288 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,3280604112447626963,216707907002158587,262144 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,382863299128346385,4065384608454688294,524288 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,2901362742188931354,12393191567283106109,2097152 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,12547431096694262022,7987939444937284787,2097152 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,16124242523651280705,2892434147065280112,2097152 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4264 /prefetch:2
    3⤵
    PID:452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,8928815288233108755,5464021934475550470,2097152 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,4789610734413220150,8386784183926216673,524288 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:4964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,1348368254126556617,14720317171127770311,524288 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,7450831275089172568,11454053999490419211,524288 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:3484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,3554448297794590378,9928217449203557754,524288 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4296,i,14922702689289070829,16889580086753272131,262144 --field-trial-handle=2064,i,372391589324662821,11240952507345916735,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    PID:4236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ee8bfc9-786a-4b50-a1ae-a3dcfde13077.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3ee8bfc9-786a-4b50-a1ae-a3dcfde13077.tmp
Size 269KB
SHA256 4aa0057c282603fbb1fd29fe9bb7db59bf40b5a33dab7435d9cfa7436c27c5e6
MD5 a781e059007f4a4d60c872b085cb3e13
SHA1 358aff002ddc73b7b2c3c563e2ef4bbf830f336e
SHA512 f0e2a090e8389b452c927eda9c747679579ad2d2309e0ddc2ff58c4ae422e77f775b7fffebfa0bb3fc1e4cd99fec2f927719ed15151a4fdedde64cc634a39a3c
SSDEEP 6144:qKyQcfSxZLpN1YNTRJsX0qZcpYPgv3F+hFD+7t56OD9ZfSApprQ:kfqrpnIlJsXzhQ3FyFSXD9ZfS4O
TLSH
T1484412B6A59ADD7BC9755282F0B3B390CAB12CD8849D1F4504A25FCE626FD480353B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87489e08-2312-4763-9c23-b9f557ee73cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\87489e08-2312-4763-9c23-b9f557ee73cd.tmp
Size 270KB
SHA256 e5ab11b50605fd8a5bda6a8e5bec923baa7677f1724e66b8c78bf78464f32e42
MD5 b722b95789005be2c40f453d7e4da65b
SHA1 93ec5f80e53fff908ac81c6b714236f473694a9f
SHA512 0202193e53bab2b1e0c47e4327d7ecbb2d61ed2bf69aeec363aedc08e5604995f0dbdc08ac26775c275da899a17caa932e65d849472de90ac9a0710b37fd7fd7
SSDEEP 6144:qMQyQcfSxZLpN1YNTRJsX0qZcpYPgv3F+hFD+7t56OD9ZfSApprQ:xfqrpnIlJsXzhQ3FyFSXD9ZfS4O
TLSH
T1694412B7A5A6DD6BC9755281F077B390CEB16CD9899D5F4808A21FCE222F9480313F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0130a59a-f318-4f25-bdc6-2f77c07cbad3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0130a59a-f318-4f25-bdc6-2f77c07cbad3.tmp
Size 13KB
SHA256 6b13da37eed84e33a129464495d503b8d2e0e70223d743f72e976239ed206f92
MD5 d8e7cd2ea3834b635edbe22165a37fbc
SHA1 df37f5ab3edeb305ca98e87b14fe5782d168a5da
SHA512 003a9e53b1142f8b87c27ca571f2f201095fb2120137ab50f75470368dc8c5b03a5c26fe8c6d43d9c12b1042e39c7cf9ea82d2737ce28062df70f033fd5851c3
SSDEEP 192:SRs0K4RUkKUgrtpv7GpBPRp1C96Hsb+WNn6E0VZeIiS+Z+VyIsnAUgraJ:SRs0K4RUkJCpCLXoswj0xiSRe
TLSH
T16152A42DBE10793B6CDBC229F9217B57D7F6102624902E40E6FC8A3C25E7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623a9c41-2cd9-421a-b82e-f010b2bda6c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\623a9c41-2cd9-421a-b82e-f010b2bda6c6.tmp
Size 414B
SHA256 695d4b4c9d13567e51deb0b833615ad8bdbcb7094a8a42e0687554f6af7837ef
MD5 7993e0b9a4431974ee9edae7173fb227
SHA1 7391aca254813bd953a06e348af8c5c495357d77
SHA512 9fe2c8654bea6a61bf5d12cf9b382056a1eda88dd226207764025534694a4545bd52e791ee85c625f444789f5815388a119fbc930f22c79c651b5942c6fee84b
TLSH
T10AE02BBAC821FC372DFD1B2D51504B87E74513173641940F7A3C45098F78A3601C989C
MD5 SHA1 SHA512 TLSH

Submit Download

94852b8d-6a2f-413b-a279-1e3b9c24952c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\94852b8d-6a2f-413b-a279-1e3b9c24952c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b8b00b2f-79eb-4a04-afaa-09854c5149f9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b8b00b2f-79eb-4a04-afaa-09854c5149f9.tmp
Size 2KB
SHA256 325ce58ccbccfda0e59a2d4b8ab7d61e75197e6c78526aab0897f73c7493ec55
MD5 ca58cb8739525baf4f1247a26474d4c0
SHA1 cb7ce1f1ae45f0f399ae55291cac0d83284d5d46
SHA512 7991c8f03b09cca8962189d6ebb0e429c2c998e35807101d57945ea99d412fe2141f414ad2e639a55e16de4821369317a3576497694979ffa16fde95951538cc
TLSH
T1955180F7C3E4857DC51196F4AB256E1FDD2D0A18122C3C66C8D4AE5B53F2872D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 9805ff9b8f0870aa885787930eb9839511b1a4795cf98e86b05865d1b9109f65
MD5 cb14e5e50f7148b49c8fd7ae3b10047e
SHA1 b9dbe2c36c3505f6a0071559b657228a8a1644c8
SHA512 5b7be1c2d56d7fb4a38f3feca4996b3e0375de16e297e3e524fb9b79a42450273beaa5719b32bf000f68edca100396ee184bcd151d1620d414df5493c34f3843
TLSH
T122B01295C0812771C44103F11690D19437608F38D5322385C1E41D22C9312905417118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 4e0b7030e98bf96daf5e86a082c8cc4044f98042dd57dace0ba77ef24ef16612
MD5 d22d42e99caf7365c6ae1aa312590901
SHA1 7318fa8e08068914b9a5cfd6a137aa35f6ba3e56
SHA512 40d233d4a56ab08163908efe6834b73d79b2f285454f756b455c181f29af21f5e9245521f2ed240aad19923d8613d1d57c3b55fa28d7017aa8916f96ce736357
TLSH
T1B1B00265C1026622C0C203F169ED95D87560DF29C713221B92E02A7ADC356A195769A1
MD5 SHA1 SHA512 TLSH

Submit Download

b5770f66-08b4-4b0d-9296-e9753ff10fa1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b5770f66-08b4-4b0d-9296-e9753ff10fa1.tmp
Size 12KB
SHA256 5c433907d8825b123024ec42796d31176e7dddac136ae0631e0ea5e8aa143d15
MD5 7b0a491b6ebc288dc9d72c5d1eff0ddc
SHA1 d276b632f46a2734d49efaf1c47ae2fdbf42f412
SHA512 ba2b41da927b1539c350e6bf8108478fe546ba0f4b7038518179ac0b38f35ca2e428aae6e7e53282eda6456fb489c263aebe51493cf6c75fc19e30b98bc690b7
SSDEEP 192:SRs0K4RUkUUgrtpv7GpAPRp2C96Hsb+WNn6E0jZeIiS+Z5VyIsnAUgtaJ:SRs0K4RUk7CpCUXtswj0ziS28
TLSH
T1F742A62DBE10793B6CDBC329E9617B57D7F6102624942E80E6FC893C25D7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5ff8bf7-538b-4cbf-a64e-d1a94b1ba6a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c5ff8bf7-538b-4cbf-a64e-d1a94b1ba6a5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f1236938-b800-4bfd-b042-254c633d5136.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f1236938-b800-4bfd-b042-254c633d5136.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0c5eca9-09ce-49bf-9e87-029fe3ba71e0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a0c5eca9-09ce-49bf-9e87-029fe3ba71e0.tmp
Size 269KB
SHA256 2de7ee4ecfba657ef3fb2ef904f7774837e452d120b7f8a684eb6aa411f74489
MD5 8586e81c5af6c16f5b25ae223d057c0d
SHA1 ac1af72d84ca2c7b1f098226550c1f45302f73d7
SHA512 97abdb92ec198b7092132153e8e077c27cc2f2256e189e753592124213236a02f357d40d32e44e4841ccc6e5e436a9bc42dbfe983a7365dab3017933c13db7fc
SSDEEP 6144:VKyQcfSxZLpN1YNTRJsX0qZcpYPgv3F+hFD+7t56OD9ZfSApprQ:HfqrpnIlJsXzhQ3FyFSXD9ZfS4O
TLSH
T18D4412B6A59ADD7BC9755282F0B3B390CAB12CD8849D1F4504A25FCE626FD480353B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae7a9078-fa85-4b1b-adc1-58ff28a53454.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ae7a9078-fa85-4b1b-adc1-58ff28a53454.tmp
Size 130KB
SHA256 0729a3abc5792b60d29902f64328e978a3071280978f48d7af243cb115d08194
MD5 09d05c6006aff172879c9c421adadcc7
SHA1 80d7e51966bc2263e39de280b71b593c1296735b
SHA512 cc4ea3ae1f05e3f62faf5d4139d03132e359394d72184336a2cffb796dc6a1ee65a44046523f33d1bf22fc361050c0bc04e748799a2a99f530a231470a6b2666
SSDEEP 3072:UA+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UA+hFD+7t56OD9ZfSApprB
TLSH
T1E3D31232AA91D8BBC9BC6541B157A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-27-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-26-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-33-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-24-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-21-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-23-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-22-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-20-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-19-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-18-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-17-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-16-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-15-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-14-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-13-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-12-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-11-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-10-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-9-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-25-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-1-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-53-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-28-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-79-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-80-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-29-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-30-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-32-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-8-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-0-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-114-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-115-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-2-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-3-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-4-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-5-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-7-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download

memory/3276-6-0x0000000002C00000-0x0000000002CA3000-memory.dmp

Download