ed2c876f81e284011a13b76b6126fbe6251284e279cf39cec53be5bdc5d19f5d

Analysis

geolocation tags

asiadelhiinindia
max time kernel
900s
max time network
874s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 394KB
Sample260623-qvqe1adt21
SHA256 ed2c876f81e284011a13b76b6126fbe6251284e279cf39cec53be5bdc5d19f5d
MD5 23b2c5cf3e2295101a9dd2225e0d0b28
SHA1 122a7f9c7134484db1c760e4c6652bf8999be415
SHA512 e3e710e05139aacbc9ba208d2ea6c197d3d3c9f9dd944ccf1631916ffd91856109fb0b54ec01f465931751fc2192823d5988334e52f83ea54976eb04e89731ce
SSDEEP 3072:Fa8wUIRzAWi2ARTDFq3F72oWFd6T2sTBAJsAaAZeH4XTMNjAGEKX9cS5rRAqw5uq:xwHRzAWi2ARTDFq3FWT/LUXaBzf
TLSH
T12884F7B2B423003AB26F11DBA0AB775E3445A49ADB468AD6F5FC1629E3F5CF1376110C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266953486077221"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4536	2412	chrome.exe	88
PID 2412 wrote to memory of 5140	2412	chrome.exe	89
PID 2412 wrote to memory of 3948	2412	chrome.exe	90
PID 2412 wrote to memory of 5140	2412	chrome.exe	89
PID 2412 wrote to memory of 6004	2412	chrome.exe	92
PID 2412 wrote to memory of 6004	2412	chrome.exe	92
PID 2412 wrote to memory of 1488	2412	chrome.exe	93
PID 2412 wrote to memory of 1488	2412	chrome.exe	93
PID 2412 wrote to memory of 2544	2412	chrome.exe	94
PID 2412 wrote to memory of 2544	2412	chrome.exe	94
PID 2412 wrote to memory of 3936	2412	chrome.exe	95
PID 2412 wrote to memory of 3152	2412	chrome.exe	97
PID 2412 wrote to memory of 5076	2412	chrome.exe	98
PID 2412 wrote to memory of 3152	2412	chrome.exe	97
PID 2412 wrote to memory of 5076	2412	chrome.exe	98
PID 2412 wrote to memory of 2824	2412	chrome.exe	101
PID 2412 wrote to memory of 2824	2412	chrome.exe	101
PID 2412 wrote to memory of 2624	2412	chrome.exe	102
PID 2412 wrote to memory of 2624	2412	chrome.exe	102
PID 2412 wrote to memory of 2404	2412	chrome.exe	103
PID 2412 wrote to memory of 2404	2412	chrome.exe	103
PID 2412 wrote to memory of 1720	2412	chrome.exe	104
PID 2412 wrote to memory of 1720	2412	chrome.exe	104
PID 2412 wrote to memory of 2792	2412	chrome.exe	105
PID 2412 wrote to memory of 1104	2412	chrome.exe	106
PID 2412 wrote to memory of 2792	2412	chrome.exe	105
PID 2412 wrote to memory of 1104	2412	chrome.exe	106
PID 2412 wrote to memory of 1548	2412	chrome.exe	108
PID 2412 wrote to memory of 2648	2412	chrome.exe	109
PID 2412 wrote to memory of 2592	2412	chrome.exe	110
PID 2412 wrote to memory of 3448	2412	chrome.exe	111
PID 2412 wrote to memory of 5844	2412	chrome.exe	112
PID 2412 wrote to memory of 5844	2412	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd3ab8c728,0x7ffd3ab8c734,0x7ffd3ab8c740
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,2522081172584382334,7160216937494492430,262144 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,3807301456674961133,8773753152510605010,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,14075443033732488854,10351812298209510726,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,8999726430924474204,4996293962885995433,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,6886168788730887299,9390290680299956187,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,7517363585680176277,237444770839266905,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5556,i,283181581871298905,2652185080974931849,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5584,i,15713723029039587049,15799270439506642087,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5760,i,2669065414868172567,16339623394709882865,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4724,i,12874564516523272822,15167672225236759868,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4820,i,13559828220042736368,12857252476879824644,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4816,i,7601301347367686952,11870117009293715469,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5668,i,6823897838252321241,18281210024525208349,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4936,i,14486034882669531598,18167789593349001772,2097152 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,17773321052701470741,7469503774125472889,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,756364089649070731,4259381480120123361,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,17986046498531673943,14519642194093801905,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4952,i,10598424175599335910,436964340640545454,262144 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,14576614748809493677,16376944901451711983,524288 --field-trial-handle=1916,i,10889925610943308174,7391909557434013166,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:5844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4300

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 661722325c9fba86eeeda68c96c87666a3306e66d1b4fd7e96cb894c086d5ec7
MD5 933c7b680f4ff67299f09b11b217a4fa
SHA1 cdd9175f83de599655c9ff8167ffa210db7cd050
SHA512 064b4c0edbc239d9a67040651301a9df477c0efedf95c8ef1b53c0913816de8aa286e2a5795be53f469c1a4b2f1d0984238b303ff6eac315c665dd338ad0f352
TLSH
T1DB61B0B7C3E8877D851152F4AB256F1BCD6D0919432C3C6689E4AF1F63E15B1E20069F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 703396793ca9d37d91cac5deae762043544443be8f42d7ce39fe1a76464fc6a8
MD5 632b2b134ec8aa40c0330723d6f14901
SHA1 7438e1315994a979ce8b02331ad1e82ef935ca3f
SHA512 600058c6cbcd4e0b310be651ca8d95582e70c2fdae379f9701ea9e9b47a0b5a982b5800aebf5ac093940038069ff23fa56cb64160fa8fab26f12da70ad3e5ab1
TLSH
T1C8417BF7C3E8897D990156F8AB152F1BCE2D0E64532C3C56C9D4AE4F53E1972D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b48a60a93d8dadf795f9f269499cb7862c8441fbb2c55ee7a4805437f62220a2
MD5 87516322dffadf3b59bcb58fa2fb7f1f
SHA1 798b69d5d503c7a7ab4cb01c2c30589412cb64ce
SHA512 60a5853aa66cc50cfe18889df6aa780d16f3388464d460fb0a4f378d64bbefae437e6262d27c45937d1676f9daa0da243f3b3477b8dd14d8398d7cabb0d78617
TLSH
T18161BFB7C3E8877D891152F4AB256F1BCD6D0919432C3C6689E4AF1F63E19B1E20069F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 251d1373810d4200da33b360dc8db9d4812e9f41246d25f6806b256abb746621
MD5 61cc0a49500c0282b090925dc9ffd231
SHA1 525c816df8af232f07222556e349686f56f79aa4
SHA512 a6b3edcf76dd812044cb90a067d97a591ad94e1496ed223b31f096fd158a3d76230456aa1da363dd465eb7298ebd5bc9930231a0617b4a95b9586591dbbffbaa
TLSH
T19C71BEB7C3E8867D881152F4AB256F1BCD6D0919432C3C56C9E4AF4F63E19B1E20069F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 72632ec269ed3f9b4c6418bbfbf0591cd981a71c7baabdc3d9b7881274611794
MD5 9c1dd288ff27248def334b2fc7d8d7f0
SHA1 25e392301725bc1f30f61d45c41f9a1bbc0372c1
SHA512 7a79008d3463b13ae7f8f45cc7bf1e242388c66a225f0e945e8358c3ed40ec7aa6e042b87cd732b3fe3c9e5a534e486ca273ce2eea70fb5326a00baab6ae7154
TLSH
T121118067C6AEF41B543E98A71E04FC0E987AB831028268F5DAD6926CB0915F3071A897
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3bcfaf60b3d4d8902f80ead4d34539ab8f71be44c2d413d7463cdb3fcac73bac
MD5 7021ba05ff1d4f41f29a6df39fac24e9
SHA1 544c7db3cc730ed6a79fba438812f1f91e28a6ea
SHA512 3421b6cad7ecb4d73f97abae42705d73c1017b5f2f90c2268c4538f49d8f36d36cf08fb1ce075f1b480db7d3a39656e0161e7572fd1209777637277473d47171
SSDEEP 192:CR4HZILv78vAPRp2OA9UHsb+WNnjYP/JeUHVyIsnAUgR:CR4HGzg6XwKw0PjhR
TLSH
T12122752BAE14753B6CCBD22AFA65B753E3F5102132D41E84E6FC8A2C15E79CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a492c33f453822a8979d4a9b735197a788a3571197876042fff47025dfb4ded6
MD5 346fc662910bc67a5ed20aabc7ae9948
SHA1 06bdb9fc06aab8be6f8d1b67602c9795864f19f7
SHA512 4af2c4dd419d488457027069b6f2a1245900eaa283cde0612bc77c6f00f8646925ce785c0a72d9e0745de8e296994d7512f919f443fbee987d82084e4dd6924b
SSDEEP 192:CR4HZILv78vyPRpiOA9UHsb+WNnjYP+JeXHVyIsnAUgE:CR4HGzgcXUKw0PzhE
TLSH
T11732952FAD14653BACCBD629FA65BB53E3F9102132D42E44E6FC8A2C15E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 f869589e66312c9b3f185d28342246087a575847be11fd0d21f65df4ca420508
MD5 a3f1df2b8298b44dcfbd7129e66ac8a1
SHA1 5f324f2f69ac6accdd7f44f7382bbb8a3116ad6e
SHA512 ff1d6d3d5d7489a62932ccb4f788e860221a540504d1035a1f82064195e498baff5d5ccb962cbd346a54f006419bc6f51c5ea057e3b7111edcbb42fa013175f3
SSDEEP 192:e2N4K6CM7KxkXqK4I40pUZNCgVLHrKHfFKslEO+kXzKD/RU+ErUkKN9KGl9VvOfB:/NjpM7KxkXqKf/pUZNCgVLH2HfgslOkV
TLSH
T1D532F827A84D9A7F4FD8E408DC566B8B6DF5414773780C2492FF9D0803A97CA114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 50KB
SHA256 cb15cc42580c56408dbbe97afbc947c33d78b9388d0e829419977c5ee37fe6b7
MD5 c21440098fb510b40dea66402632cf8a
SHA1 c06084967373ababcfc372fa8b26da76efae4787
SHA512 8b2b13580732b90a51d6a49c3b58673d844d86e023504c103235f5a24bf6714aad9e2bfb8f99d6b53080442445922c859d3512c8d0ddeadda6b046f00d839d02
SSDEEP 1536:KvphcQiZPjKcLcnujl0CFxO6W79IQP+gzH:+phcQiFj/InuLFxO6UeQP+gzH
TLSH
T18C33F170E09CA8F71EAA488932553A0B8DB456F9945E7D08DEED5A2491D3CB1B783037
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a84713d1f4261bb5577964a97634e0fc901e4877a3564bc6cfcbf6c527da0cd5
MD5 5d8feb07fe8fb5e3450f4b7a74085eeb
SHA1 eaf28fcf86757941fca24056b8bed8357cdb846f
SHA512 61f31e8cc1b6e2d5142f5300e16798a89ce043e5a369b33a0aaabed51c8037a11e331f94e38b5d6429316673960e808c8438b3832cc6e0b45938cc4677dba054
SSDEEP 96:tbJ6zd+0JdBXgpHy6xfYBxd65isSl8h4otop5GQZADYB6jJGyvGicaTPpb0j9IBk:ttALJdBXgNy6YIiU2GA2sg0IcaTRbUf
TLSH
T1A5C10871687D5CBB58F6E85574033D03CEB0618BA682AF68DADD4F0C02E78EC2352217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b1c32bfd1def28c57d269fd01b08403164e469cac2ff9e92c342eb4ec11590e9
MD5 ef56c68744ea997c2c963aefb87b037b
SHA1 caf4d8fd7110cf6f934a9a551b504c7688b03f7e
SHA512 1c1529b330f8c77bab6b3e38d7d5c688c2ad87e0c80e62a05eb0bc41383ee5e30b4b670a174f8fddf87c6d5b84e4baddee54206bc9247bbb1856f16aeb258856
SSDEEP 96:dC6zd+0JdBXgpHy6xfYBxd65isSl8h4otop5GQZADYB6jJGyvGizFTPpb0j9IB+B:dCALJdBXgNy6YIiU2GA2sg0IzFTRbUf
TLSH
T151C10831787D5DBB58F6E85574033E038EB0619BA592AF68DADD4F0D02E74F8235211B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5220e3cd6bdc7f455e5a9e4ed11cccb17d464dc40f7e9be631231039de08e13a
MD5 69ca279f2fe9865cdbe0fdf33c97d95c
SHA1 4e5858d4b719d745bec057347dea8ae94046d6f7
SHA512 498765294a2cf74ea3f7a4d38946e5b258373c69287febe4a3d121cfc4941a8187fd725781986db7a612c96764517482edb4b80a8215b161592660bb6cd0244f
SSDEEP 96:dC6zd+0JdBXgpHy6xfYBxdM51RDotok5GQSDYB6vGyvGdiPpgbsYv4a:dCALJdBXgNy6YGDUDGfsT7iRgbsC
TLSH
T144A12832697C8A7BA8B6C84538123B038FB4608BF192AF98D5DC0F0C21F34F90352617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 1dccd57b116d8508c808292b06bead6f7b6e2c6003a76fcb93d59b541299307c
MD5 b44b8b7f4bff8bcd02c5c7fac81d1dea
SHA1 36bfc2e524ff395029332ac8831bbdded0fbbedb
SHA512 a4cb4cd9c874aff0007a2a0c8a4964db2ae3ab28581db2baf6e73cb6c965487765eea99c35d6565eef40f823fdb78236e165f614d26c0112e3641d200a6a6f0a
SSDEEP 192:ttsLJdBXgNy6YIiU2GA2sg0I88TRAuCH0:ttqPYyIkxgX7RAuCH0
TLSH
T158D1F771A86D4D7B5CF2A84570033E138DA4219BB685BE68E9ED0F0C10E38ED9392227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download