9b14621b40e983b22eaaae1bcf2193136dc9b31b73fbd748564d9a1310776b70

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 57KB
Sample260623-pvpm2acy4r
SHA256 9b14621b40e983b22eaaae1bcf2193136dc9b31b73fbd748564d9a1310776b70
MD5 b2803b3c548bb1b71f190e0216785c68
SHA1 0e967067b5cf86f559e9a606f3f6e78cea7b5b21
SHA512 9d9925a577d89f30c318d43ca8e9a5149d711e95c43c4c1d8220e788121d5a597229afbfe09d6278e7673170864f1c9ef91605c62ae408189b5d925b0a1cb55f
SSDEEP 768:a/yvV72MqMZRfmzOt26Ws/g36Or9v96AgtWGyvV72MqgZRfZtWL/g36Or9v96AGv:a/akfxOeHfx7e
TLSH
T1E943CC6CA62C1EC44E698EE11DA162B16A1E036F8749F70CC3A7C774B52C0EDED51D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6100	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266919772750758"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
2652	chrome.exe
2652	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe
5460	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 5584	5460	chrome.exe	89
PID 5460 wrote to memory of 6100	5460	chrome.exe	90
PID 5460 wrote to memory of 5612	5460	chrome.exe	91
PID 5460 wrote to memory of 5616	5460	chrome.exe	92
PID 5460 wrote to memory of 5612	5460	chrome.exe	91
PID 5460 wrote to memory of 5616	5460	chrome.exe	92
PID 5460 wrote to memory of 2872	5460	chrome.exe	94
PID 5460 wrote to memory of 3608	5460	chrome.exe	95
PID 5460 wrote to memory of 2872	5460	chrome.exe	94
PID 5460 wrote to memory of 3608	5460	chrome.exe	95
PID 5460 wrote to memory of 6128	5460	chrome.exe	96
PID 5460 wrote to memory of 1408	5460	chrome.exe	98
PID 5460 wrote to memory of 1408	5460	chrome.exe	98
PID 5460 wrote to memory of 6924	5460	chrome.exe	99
PID 5460 wrote to memory of 6924	5460	chrome.exe	99
PID 5460 wrote to memory of 6308	5460	chrome.exe	100
PID 5460 wrote to memory of 6308	5460	chrome.exe	100
PID 5460 wrote to memory of 6524	5460	chrome.exe	101
PID 5460 wrote to memory of 6524	5460	chrome.exe	101
PID 5460 wrote to memory of 3108	5460	chrome.exe	103
PID 5460 wrote to memory of 3108	5460	chrome.exe	103
PID 5460 wrote to memory of 4696	5460	chrome.exe	105
PID 5460 wrote to memory of 4696	5460	chrome.exe	105
PID 5460 wrote to memory of 6876	5460	chrome.exe	106
PID 5460 wrote to memory of 6876	5460	chrome.exe	106
PID 5460 wrote to memory of 2728	5460	chrome.exe	107
PID 5460 wrote to memory of 2728	5460	chrome.exe	107
PID 5460 wrote to memory of 3996	5460	chrome.exe	109
PID 5460 wrote to memory of 5664	5460	chrome.exe	110
PID 5460 wrote to memory of 3336	5460	chrome.exe	111
PID 5460 wrote to memory of 2652	5460	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe6764c728,0x7ffe6764c734,0x7ffe6764c740
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,14963476956702262165,12925251850200142631,524288 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,6245233426327622771,1627571225374872944,262144 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,11218620406133957495,989753841328218390,524288 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:13
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,6467218140206520527,10356549232878378047,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,2411698711782201544,5793014249669737985,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,1411966170863154786,11214624320598733734,524288 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5300,i,9056783417750241532,3398980003132050671,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5372,i,2352025022655336336,8944001086092904264,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:6924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,5538979761713284807,11406935296439325561,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:6308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,4228441637881913892,14583418977748064160,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6048,i,17544451496907137845,10252508109456688745,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6188,i,15449085650114805427,17441370824624658055,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6308,i,687335976035328947,6842023117274366783,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5828,i,1960069587688207301,2559164092384166653,2097152 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,10939203075546683184,5779501611013134089,524288 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,7777428501109133489,12766034276643485995,524288 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,9301758490489113954,4523383374829643650,524288 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6072,i,12648565538234732957,15722102793780303200,262144 --field-trial-handle=2064,i,12328600547739618904,670560277642719811,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6b648a260a2ab2744f811999839b3e903994e2d7e2168bd9d85a36557d5c7cc8
MD5 a49d3db5f63f40aac91001c4b7f42fea
SHA1 483eddbd22d41d4bd1e492dce3b4b45d794f4a82
SHA512 85f538c04dde74014a7e0cf412051ac484527fdb0e015163dfbc6a416a86918ca13eb4af12641f57d3ba358ae4dd213adabb2a1e4d7555e94ea4e03bba439322
TLSH
T107417AB7C3E4867D991152F8AB256F1BCE690A18432C3C62C9D4BF0F53E2972D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d3713448b9245fdf77869c6a38c8cbd9c0a5ba686050b707eff51cefd55f9545
MD5 624065a2060eb233156e450b195a17c5
SHA1 0c04307e100bceceb6cc59679abd40443d321013
SHA512 63a28bff4912c0a5fa3a262d058faae8d2ebfec965e0fbea34f70068347cad93e1245c099606c406e34c4c10d8b728cd7e3379961b3050aff085f873720ff746
SSDEEP 192:sRl8VTJv76JhvAPRp2uY9AHsb+WNnQNPN0eA6VyIsnAUge:sRl8BJQ6XM2wAP86e
TLSH
T11E32B62EAD24693B5DCBD219FE61BB57E2F5102271D02E80E6FC8B2C11D79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af4875bf9be14d2236af56c33d9b4e48080f33cdc2483f3508828aff9c03f8fe
MD5 3f9ab5779eadd76e8301f9d9d24b1e61
SHA1 dcbed9b27ef5d2cf8ca2775ff0134190ed30bf27
SHA512 89670b64b593c8bda6d5dca97dab05db3ab08cc863071f86aa82c2a1684d9165e626343da3f470d29312c19c1dc90ff534964be20680af23fc63e58636395ea8
SSDEEP 192:sRl8VTJv76JhvMPRpyuY9AHsb+WNnQNPG0e76VyIsnAUgE:sRl8BJQ2Xg2wAPI6E
TLSH
T1BA32A42EAD14693B9DCBD259FD61BB57E2F5102271D02E84E6FC8B2C11E79CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d1e277aae102aa5d0c705693418ccaf096bbf71954fd55e413952b96a9345eb6
MD5 79d97801c2572187d66d6d77e240cd54
SHA1 98d5329de32efdd32c33b9f0edf35f4478abe26f
SHA512 51fc33ba522952a32719772b310a61068c7ad9a346213b5cf7ae6ebf6439c1201fe27ef76612debbb1e7a11883766720a0dce5a67b4095f23198e569996cf369
SSDEEP 192:eov4K6CE7KxkXqK4I40pUZNCgVLHrKHfFKslHgWXzKD/Vs+ErUkKNwMWLp/B4ZM:Jvj9E7KxkXqKf/pUZNCgVLH2HfgslAWZ
TLSH
T1AB32D927988D9D7F4FDCD50DDC166F8B6CF5029372680D2492FB9D0803E978A524A2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 47edd0336c010bc53cd4bc0f15a40c8860068329c3f4453e8c836fd68a5519fe
MD5 a4f7eb48fdba2951eca8ab1b0c15b588
SHA1 a03f347245349128b22716552243c44a73ea6abe
SHA512 0090e85be6312da49a828aae614707d2a286bd17f9ddac38a80bc3d5eeb2de0d931c5f1c84cec695e65c5e8e08c450ea869b684ca9971f2a5f998c5f795441f7
SSDEEP 192:htbfls4fFKs6l3ViU2EjnQtBLcCICc/uCuhs:htblbws6l3VhTnMc/uCcs
TLSH
T1FCC1C671B87D9C774AF6A845B1032E038DB8615BB9917E54EAE94F4C00A78DD2342137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7a2b99bc04655a0a23a3ffc6943c7c4b6ff592539384fb6f56bef975cf673701
MD5 e0fb8f482b250e08dbce4fe8c603e379
SHA1 e2309d1a02ca3dc0eac2eb0499588993c39df512
SHA512 e076933f568eff6062d7aadf4d7b1caa1bfc5c06f8915128d24df833bcdc8dacc7ac24f8ceb3bff7d50a548d18883a43eda2a9dc16b2f66e6bdc34cd1ae2d2fb
SSDEEP 96:UMC6bod+klsgvZRFKs+X71f/3uliSl8h4otop5WpHDRB6YGyvE1BLcV3HKiCcsKA:hCbfls4fFKs6l3ViU2EjnQtBLcVaiCcY
TLSH
T1ABC12B7178785C775AFBD846B4036E03CDB4A1ABA691AE94EBE94F0C01D75EC2342127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4beb5b03166c1e03a110f71b1238fd8588d584425ea88a2c78bb6ef228e8b714
MD5 892efca72e8231c3a6b2c99974f70b23
SHA1 356033756c5e26b59d7695d58b708ae6993fd071
SHA512 75e65095c75fad9b1d8e4243018defcb65afd5c0e828f12f5c93b6595d3e5cb03ca60b11ef1478acb389e70cc4bf6c6dbcb9d3cf508275589efe3a7bd9938efe
SSDEEP 96:UuC6bod+klsgvZRFKs+X71f/3Rl1RDotok5WpqDRB6eGyvE1BL+zcsdbEs3v4a:BCbfls4fFKs6l3DDUDEMn6tBL+zcAbF
TLSH
T1DDA10A72B4788D778ABAD985B5927E03CEB46157B5915EC0D9ED5F0C00E74DC2341137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 19c8d4eae4917348bd169ae0b56cc905ef69de09eba20822e7e1401335f6900d
MD5 cf8913fbfa85d7e47bd4467a30804452
SHA1 ee861878425240c4e02d04c5dd9c7da79de50535
SHA512 41b6cc49dfdb81518f569733ce3a263587862a33560550320c77d36cd194b434a4bb34072990108d02e47dd4c9008ba1a32ac2eb7966ce49d292db65c81d8dca
SSDEEP 96:UMbJ6bod+klsgvZRFKs+X71f/3uliSl8h4otop5WpHDRB6YGyvE1BLcV3HKiCcsp:htbfls4fFKs6l3ViU2EjnQtBLcVaiCcY
TLSH
T187C12A7178785C775AFBD846B4037E03CDB4A1ABA691AE94EBE94F0C01D75EC2342127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download