8c286957db8fb49332611ca55bdfbc610bf8f63cecf2c1c9540e01d29e56e685

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 57KB
Sample260506-vrexbabs6q
SHA256 8c286957db8fb49332611ca55bdfbc610bf8f63cecf2c1c9540e01d29e56e685
MD5 79076a032fde2c6d3c3bc46c4c15ded9
SHA1 ffd89f4ec57e66a4756349c14bb56a06a19f10b5
SHA512 12198852d31c205b84a96e427880053c8b79155ec312cc4a8ceb625b739b792e598cb21801b2b3e6815a461d2572f33617fd2a9539c7fcc51364859a891e5b73
SSDEEP 768:a/yvV72MqMZRfmzOt26Ws/g36Or9v96AgtWGyvV72MqgZRfZtWL/g36Or9v96AGI:a/akfxOeHfxFr
TLSH
T1D543CC6CA62C1EC44E698EE11DA162B16A1E036F8749F70CC3A7C774B52C0EDED51D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225612101001236"	chrome.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: 33	5804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5804	AUDIODG.EXE
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe
3856	taskmgr.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 696	5192	chrome.exe	83
PID 5192 wrote to memory of 3860	5192	chrome.exe	84
PID 5192 wrote to memory of 3860	5192	chrome.exe	84
PID 5192 wrote to memory of 6072	5192	chrome.exe	85
PID 5192 wrote to memory of 5016	5192	chrome.exe	87
PID 5192 wrote to memory of 5016	5192	chrome.exe	87
PID 5192 wrote to memory of 3448	5192	chrome.exe	88
PID 5192 wrote to memory of 2228	5192	chrome.exe	89
PID 5192 wrote to memory of 3448	5192	chrome.exe	88
PID 5192 wrote to memory of 2228	5192	chrome.exe	89
PID 5192 wrote to memory of 5148	5192	chrome.exe	90
PID 5192 wrote to memory of 5148	5192	chrome.exe	90
PID 5192 wrote to memory of 4832	5192	chrome.exe	91
PID 5192 wrote to memory of 5968	5192	chrome.exe	95
PID 5192 wrote to memory of 5968	5192	chrome.exe	95
PID 5192 wrote to memory of 2716	5192	chrome.exe	96
PID 5192 wrote to memory of 2716	5192	chrome.exe	96
PID 5192 wrote to memory of 2464	5192	chrome.exe	101
PID 5192 wrote to memory of 2464	5192	chrome.exe	101
PID 5192 wrote to memory of 4604	5192	chrome.exe	104
PID 5192 wrote to memory of 2356	5192	chrome.exe	105
PID 5192 wrote to memory of 2252	5192	chrome.exe	106
PID 5192 wrote to memory of 4764	5192	chrome.exe	112
PID 5192 wrote to memory of 4764	5192	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffecd81dcf8,0x7ffecd81dd04,0x7ffecd81dd10
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1560,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3012,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3020,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5140,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5508,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5564,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --field-trial-handle=3076,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3288 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3140,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3100,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3876,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5964,i,15252029120548853782,8277264143155696058,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:4764

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2cb7dce71cc265b1f43da6f8cf3f1758c88a04bfe7c2ca925f32e7aaba3c216b
MD5 532eb4acad474d228b09f1542cf8122f
SHA1 4fee6a2d7a7a7fd50cd9334eb6c9aaa66f64141e
SHA512 c0f3aaa8e5853b1646b35a878c8daffab496847e3f5b33f945ba533cfc111871806e9b570a55469c6c0f378511dbe137c06a3efd0ca697d7ad4cfbc6455f99af
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a9b77851d86bbcc0079b04a5d9dea13d878369517b835683c5bb8c91a3b91f92
MD5 ce7e0742e7e8ec4ee694a3ed31c14529
SHA1 938158488df2a25d8857cb35862cd006b83d0ccb
SHA512 843451202172f15c7d10dfe7bf6c8d61ce3dc75d1450e65c6844dd28e03ebb249c30940acc6846fa80093df8faae4c5addd8211dae30d44ac6702a520e025cbb
TLSH
T1F1E02BAACC31DC2B09FD476D60150749D74003171BC0994F363CD20D8FB563A9586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 202KB
SHA256 9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2
MD5 9901c48297a339c554e405b4fefe7407
SHA1 5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e
SHA512 b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742
SSDEEP 3072:hNwNckLSLseINygmh3P+PericgnyCyyneg4+aa7P46i79YBvMxnXAJ/RSCJjN8x6:/FkLSLbP1+mOcFn+z4diRFjNCbuenb7e
TLSH
T1591412170BC178A8C486DAB3143DE2A97D17CF5AAB3196CA7683399EE3317C15B1910B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 4254f265832bab2ac577c9df4a366942c6e798884a607a8e05c2a8f30bab44a9
MD5 dace4f9926d736a5c25c7013ebeff6ca
SHA1 3de66de61a0b9dee4cae66b46fe2a037838b584c
SHA512 4fd0231e199ffd058e52c641527d54f6aec52c52c047ad80b81331d428deab42d69fcd3337340fe88aa995c6173d46de0af3d515d875dc00ea67aa29dfa34863
TLSH
T145D0802941C1475DDFC495398E87CC6511D5045DC415A2E7FDF495C44B132575B14585
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 5ee21370e84e8c23253051790b6f0072024cda2b7f8e2bde83e9a31fe68ab062
MD5 9f407a27529e746c227d6f1603ac2f26
SHA1 3ab3af1cef87035a0021a5d1670a7a6172b53340
SHA512 994f31c6bff5d24d8a529088702c00f33d2e836b95ba22f7a0985a1abeaab072c9e1e1a8ba40927331cdc17681f36a2dc4b79b616c2a06119d5b7fde18c8921b
TLSH
T153D0803901C1474DCFC0B5394EC6CC5561D5005EC41263D7FDD495C04B123976A54589
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c368a2026e55a5937b56e83fe3a47e6ce6ee4860e23f0e7c382d93025cddc9ba
MD5 642366d0bd722620dc482540cf6d93da
SHA1 e8e8c382f875c7175e147b8b447067d3e76e91ad
SHA512 368a24eac493d83a6e3cadf97e6ba764a3e4243ab35a5e2fffc7bb7d8b6e5a4853b37a5e807de27b4da902a50fe0350aef10ab962e5778b25e666203bab10778
TLSH
T19551B1F383B486BEC61196F45A256E2FCE6D4524072C396589D4AF0743F24B1D21034E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a1541d37c683b0cf90ed135dee2170101cb386bbfd982622257edab3e495645f
MD5 b6f56ffde1038f1b90a5382d6fc9864f
SHA1 110379da5da25b0ad0f6bb5ef904eda7a4621352
SHA512 92eeecb7844913a79c92e480d15796877da6754c210858ccf7d6a44c3b7baded8bafcc9154b2d814b64d526ffa9535014b949940330b5d0c91c0cee6ca17dda0
SSDEEP 192:JYrmeIYZ8PRpirmNHS+WN73J0GrzfvSiFzZTOE0kw1JpQyIsnA/g2:JYrmJX39caSDSqZyvZZ2
TLSH
T12F42D75DA91469BF4CD6C329FA157B52D7F5201162903E88FEFCCA1C24D7ADC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e0479e876f6f716b72ba644a6a7822044e7325b422d5b121dc60c286e5056707
MD5 9ecf529ca52347494917b39e8d05ccba
SHA1 618f9050dcd547ccd79a4e3af6bc06c11e264199
SHA512 88d9f513e86ba66305c9ac23ae1c3ae43313d03cbe66fd1331828830e042e9dbd4f36aa7ad4154a58a8792c0720aa9bf4a7031fc108eee14d3817ec64c0e241f
SSDEEP 192:JYAmeIzZ8PRpit6NHS+WN40GrzTI+iNzZTOE0kwGJpQyIsnA/g4:JYAmQXp9c7Sg+wZyvMZ4
TLSH
T11332085DAD14A9BF4CC6C329FE157B12D3F5102161903E88EAFCCA1C24D76DC622B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2133ffa88d5d3db62f77d110b8d88fba96149a4178b23f4e093c2256103afceb
MD5 45e28ec930fc2c87de0313762841b1e0
SHA1 6fb0c76233429aae67ebe12cb63d355348e0a5df
SHA512 5b3b0b22a746700865e2fcbd4e33c20b8c3426be1162b619df220b4d952a5fb8eba4f5f57a644b6208edf1275d0a414731e85126cc07a3cc1850c4aa2a5427db
SSDEEP 192:JY5meIYZ8PRpit2NHS+WNCJ0Grz+mY9iUzZTOE0kw1JpQyIsnA/g2:JY5mJXJ9cdSvUjZyvZZ2
TLSH
T14642E75DAD14A9BF4CDAC32AFA157B12D7F5202162903E88FAFCCA1C24D76DC6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fa439071d8bcd68eceb87666c4fcc104fa5f7e94c56417f3540bbe61a1e8b6a6
MD5 37d064d8a880f0c8090903481ae85777
SHA1 334a09876ffd91c3bdf7625c52a7307b68efa382
SHA512 ea4e4406809c6d2bc67a9af3e7524de5bf924527c503e97d8d14259f57d3fbd9b7667d1b014144812500205cadb7fbb69d0b41302d54041d624d8de2b02336db
SSDEEP 192:JYPmeI6Z8PRpit2NHS+WNCJ0GrztJYiTzZTOE0kwBJpQyIsnA/g2:JYPmjXJ9cdSLYAZyvdZ2
TLSH
T16542E85DAD14A9BF4CD6C329FA117B12D7F5102162903E88FAFCCA1C24D76DC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4a5be9bbe21207d74a027557250fa6598a686a43ddb16f7611099efc8a7696ad
MD5 326d200ffe550242a7283562486c638e
SHA1 ddeb3f27331ddd74338abd7654d31d0ca4709bff
SHA512 5cb28aeb03a17808cf629d3bebd0669d2fa9ac0eb51ec1092c2f330b058735c639a736b73b70b14a9c31d12bec167e6959601eb974818532cd3a280ae73ad333
SSDEEP 192:JY5meIeZ8PRpitoNHS+WN40GrzeVgigzZTOE0kwBJpQyIsnA/g2:JY5mPXP9c7Ssg3ZyvdZ2
TLSH
T12F42E85DAD14A97F4CCAD329FA167B12D7F5102162903E88FAFCCA1C24D76DC6227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 5d4a9d8177af0d11f31da01f04244ba27dc5d2739806364070d303ccbf7be33d
MD5 7fcae3e78fff7db0b85262d34f8656fb
SHA1 87c16c0a216459b37e6a0c72feaf101f1a31d51e
SHA512 968b830649c31e035031c5b7412c4584203873cb839f1ed317cb40bad4dc8498bf848f000dc24bffe98e9b9af001892da1d3742ebb55f085551179a218fa428b
SSDEEP 192:JYAmeIUZ8PRpiqNHS+WN40GrZiDzZTOE0kwGJpQyIsnA/g4:JYAmtX39c7SZuZyvMZ4
TLSH
T15B32F71DAD14A97F4CC6D329FE257B52D7F5202161943E88EAFCCA1C24DBADC122781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e8402e8d6c8d5051f786cb8da92d19a4bd89d9a69d267c9d57edb1fb0a229669
MD5 2e8c7034c3d913c6da7c2584ca09589a
SHA1 092631faf4734b4df166d73f80b289195cdb285c
SHA512 ea83442e99cf9bd94ba5415fab1c68fb4b0255cf83aff1b04a4001331afef42bdf33596e8ff0bc31146d433664fdd74ba872f3b41445426283584935c1a7811c
SSDEEP 192:JY5meI6Z8PRpitHNHS+WNCJ0Grz4PoiWzZTOE0kwBJpQyIsnA/g2:JY5mjXY9cdSkodZyvdZ2
TLSH
T1F942E75DA914A9BF4CCAC329FA567B12D7F5202162D03E88FAFCCA1C24D76DC6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2c4a07439c3cdbd0d1610339724883cba3e1d9f6f7a2ff784e847f73a32029e9
MD5 24a692ae74a54b32a180a3375100a683
SHA1 6e76e1b5d9e1a607f525b11bf9050c6ac178dfbd
SHA512 470c1f0e1be35bb396ccf5d9494f7312c383179ccd7574b4e68ed582e6cf56a66fd996687c53b9e064c16868a4f5a5beafe786b53b8da914a7b052e8efd286cc
SSDEEP 384:J5zA7pLuLceiBYXWnPkXqKf/pUZNCgVLH2Hf1NwrUo7HGGctDAnqwVHL:JRA7pLuL7siWnPkXqKf/pUZNCgVLH2HK
TLSH
T19472E8677C4C9A770F94D9CCD9267F4FACF6024B65ED886443FA982503D4EDA010A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1fa2fec031decfe8f1e5d8cc39739a07192b23fc9c0956f6a2135a0dbd21dbb4
MD5 b8f3b08abf11e8399ccb23a6a2ea0222
SHA1 6ae3a5d7d1ce21b73b666514ea5a33c0c083de2b
SHA512 380f35a45f6664e11dc546325b122b2fa266bb84e9495bf9d080a611ae29aeb88177ff478cad394424f935e4442e2aac90640eb96f3d19b459f17fdcae3d1fb3
TLSH
T1E5A0021806CA52B1C4100670108F214033745C25624107294691D5A9CDA11E2D7D3149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe57c813.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c813.TMP
Size 48B
SHA256 7bad53699ee88d65609c94a1099592e533502760edddea7acff6deb2b9fa7e27
MD5 82e46a6a19181d8817a6bd9109217866
SHA1 92c4d3fd74a4b8266520c6d655305aae63ec359d
SHA512 ca75eef28e488ff542c15961bf200b7c415007738766cd218256cc8bd1db2c8dd83164ae12b76cce7e50f3ec1ae2fd48b777bd1ff846eeeb13d44c49cdac9e62
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 ca0d08f56e9e00a066eb7c5a5ed24648b92381ab753011c508fa0110f390f822
MD5 b0c1fcfd134295d371432fee751a0966
SHA1 65884e82e5be5ac946cf59f359807f3bbe00fe29
SHA512 abd116f9bb578f163cb6b9be6e0661851d61b2cfde476a06a9c51248adcb155ed744bf7c3e3d9014b15d3fb6b8df670de63d3b8af97d7c226e925a52c26744ab
SSDEEP 1536:2SBwbXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:HwbXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T169830233A8DE3B9713A55164901B3F930D9401F725C70EE056793FE6279B8AC1B7262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 51d8185972923a2d09e1b7bad7e52be885ee95b59862d7725d1a23315e115c58
MD5 4ef9ab8ba7425406c0653c76c37bc31d
SHA1 f3d08ddd8c4a27d79f4679e5f49c1f17d275cb06
SHA512 838aeaaa57073069ca53535b4f42d195acc082a69ae3f26fad9b114d15a369beba6e73f27bc7200e44a9249d9af3343683a2b10011ee4b35a69035a3b610bf26
SSDEEP 1536:zSbhXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:AhXjM4rTmN5eWvStRNoV8cWK7XF+TwM1
TLSH
T1F0830273A8DF2F9753A55164900B3F930DC401F711C70AE09A793EE6279B8AC4B6262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 ce62a1783a5b6e99dcd302595713cc6f50ef1e74d30a95edf46bb2ed48f342f6
MD5 a98f8f527d55fcb7491e35c6bb60286b
SHA1 9942e843535bfcf9ba187aafceac18ef93eb4c72
SHA512 bf8a93bb78a40368f4d8cd1c42aa262eb53d89e0b3bfe91bdf97614a46880fac457c8fd0d072f621c7ce401745cc83e13eb537d16db5155f0bb3ab471d4ca889
SSDEEP 1536:zSZXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:KXjM4rTmN5eWvStRNoV8cWK7XF+TwM1
TLSH
T186830232A8CE3B9713A45164901B3F930DD405F725C70EE096793EE6279B8EC5B7262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 3f831becde236dec0ef7c4126742d094a0cfee1ab6b69e71f31864d3b1ffed20
MD5 5573dc6ab0c654fb49ef9e0afd053540
SHA1 6f8ebc59495d0945215de28ac9c3bc1f5552ce9e
SHA512 27f2234056e85f08c3008c3cf593ae2420288857a2b68b5debc21b42acfa89eb84502ea71da1f74ac01d1930bf22268aa0e7ff108ee6632aa1547352cc99fb15
SSDEEP 1536:zS7wbXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:4wbXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T18F830232A8DE3B9713A55164901B3F930D9401F725C70EE05A793FE6279B8AC1B7262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 ad082cd66459ebea4cef970b35f14cbee97dd8450dcd0df543ff65a04504c0a5
MD5 a86e91cf0553263c6d5d1d0060d27259
SHA1 c1a408d4deab04480478f48d858c7291e479170a
SHA512 d71e97e9a901fcac801af6e9b57c32612eb802a8ce1623135a27550f4ebfad55c8cf8e3db68cb3c4481eadfe841c592fe9c5ae9f17fb7f5813600ea079e17df6
SSDEEP 1536:zSewbXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:ZwbXjM4rTmN5eWvStRNoV8cWK7XF+TwU
TLSH
T182830233A8DE3B9713A56164901B3F930D9401F725C70EE056793FE6279B8AC1B7262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 f6c8f658769539e7dcbd03c5011bf8f276301e4c84e91bd680f4b8c86c082da1
MD5 e5f07ce5449ab83cfc10b297b1ec1acf
SHA1 8c004376b8ca14f0d702e9de895de80106388be7
SHA512 f73ae1f53dca0432b592bc9d7db876c936413f4adaa1f6dc5e033aafec64584742db3c96426848a563ba44f8970cba1f9ace162db0197bd36390db13136c3b80
SSDEEP 1536:bSyiXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM1:ViXjM4rTmN5eWvStRNoV8cWK7XF+TwM1
TLSH
T1CA830233A4DE2BD713645164841A3F934E9505F725C30AE09A793EE6279B8DC0B7262B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3856-211-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-212-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-210-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-209-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-205-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-203-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-204-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-213-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-226-0x00000211FFC40000-0x00000211FFCAB000-memory.dmp

Download

memory/3856-214-0x0000021185380000-0x0000021185381000-memory.dmp

Download

memory/3856-215-0x0000021185380000-0x0000021185381000-memory.dmp

Download