31ed38ad9fdbfb483ea2562881505f69258b7c5daf1278dcb7a09a26ff39c595

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 802KB
Sample260626-txadcacy6t
SHA256 31ed38ad9fdbfb483ea2562881505f69258b7c5daf1278dcb7a09a26ff39c595
MD5 8e9b80e50d9b5f8d205b1f0b6a0ca318
SHA1 e70c2988f2014256b3608a27cf5fd4b9a41ea36d
SHA512 23115fbe4ce1245d733a459222274d05ddaf50b5bdec0e305d485bc34e0e16234f25df7ef2b0f1402e85ff76e42b1e248182b982159b46f1f925097fcbd9607b
SSDEEP 12288:VX/6Z/6a/6v/6m/6S/6b/6d/6g/6C/6Q/6//6nqBffe2lS:VtcS
TLSH
T1FE055F64086868B29867A547DEF5EF3E9CE0173D4BC5C96EBCB7D39C01ECA104DAE412
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6784	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269648022057124"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
1196	chrome.exe
1196	chrome.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 5948	3068	chrome.exe	90
PID 3068 wrote to memory of 6784	3068	chrome.exe	91
PID 3068 wrote to memory of 5212	3068	chrome.exe	92
PID 3068 wrote to memory of 5212	3068	chrome.exe	92
PID 3068 wrote to memory of 5424	3068	chrome.exe	93
PID 3068 wrote to memory of 5424	3068	chrome.exe	93
PID 3068 wrote to memory of 6568	3068	chrome.exe	95
PID 3068 wrote to memory of 6484	3068	chrome.exe	96
PID 3068 wrote to memory of 6568	3068	chrome.exe	95
PID 3068 wrote to memory of 6484	3068	chrome.exe	96
PID 3068 wrote to memory of 4448	3068	chrome.exe	97
PID 3068 wrote to memory of 4448	3068	chrome.exe	97
PID 3068 wrote to memory of 1240	3068	chrome.exe	99
PID 3068 wrote to memory of 3524	3068	chrome.exe	100
PID 3068 wrote to memory of 2264	3068	chrome.exe	101
PID 3068 wrote to memory of 3216	3068	chrome.exe	102
PID 3068 wrote to memory of 4792	3068	chrome.exe	104
PID 3068 wrote to memory of 4792	3068	chrome.exe	104
PID 3068 wrote to memory of 1236	3068	chrome.exe	105
PID 3068 wrote to memory of 1236	3068	chrome.exe	105
PID 3068 wrote to memory of 3504	3068	chrome.exe	107
PID 3068 wrote to memory of 4160	3068	chrome.exe	108
PID 3068 wrote to memory of 3504	3068	chrome.exe	107
PID 3068 wrote to memory of 4160	3068	chrome.exe	108
PID 3068 wrote to memory of 1056	3068	chrome.exe	111
PID 3068 wrote to memory of 1436	3068	chrome.exe	110
PID 3068 wrote to memory of 1056	3068	chrome.exe	111
PID 3068 wrote to memory of 1436	3068	chrome.exe	110
PID 3068 wrote to memory of 1780	3068	chrome.exe	113
PID 3068 wrote to memory of 2348	3068	chrome.exe	112
PID 3068 wrote to memory of 1780	3068	chrome.exe	113
PID 3068 wrote to memory of 2348	3068	chrome.exe	112
PID 3068 wrote to memory of 1196	3068	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff3fd5c728,0x7fff3fd5c734,0x7fff3fd5c740
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,14905133655157940179,13088792004034925100,524288 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,8103490571783878764,18037011344900101582,262144 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,1108743805597810625,2111845008496383528,524288 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,17655190621596018298,9367528246921505745,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,7676258319750085522,4355409982768243279,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4984,i,18345148685426794126,2844078829548598021,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,2553383667693730052,340343879253101870,524288 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,938111744398285577,12920970761572901947,524288 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,13966350172397814854,1644060611314826887,524288 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,4324615382317503611,4536752589885804585,524288 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5208,i,1681265787311988456,12396415242723354164,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4988,i,8446536475413567847,12091829382292694567,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6160,i,9880962205626827239,14215485784007171607,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6248,i,13284095479996641188,3954225614714962775,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6252,i,5366943062102451426,1416263548261558059,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6288,i,1889378917143250311,5934850417753154139,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6284,i,9077369473585631425,13879914166666820456,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5252,i,14398525425062525565,11253243176989157138,2097152 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1108,i,222424886796171322,552061375504738378,262144 --field-trial-handle=1908,i,15628332254698537987,10590007799703622387,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57f4efd8-0098-46ba-8604-86c1eb6e8c73.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\57f4efd8-0098-46ba-8604-86c1eb6e8c73.tmp
Size 5KB
SHA256 b1c2bf510505b48ffb0c3ac1f28d95a3d620c19e47ce7acccb4d8e90cd1ace5b
MD5 5e58047b0b5c09413ba424471c44dbbc
SHA1 b60340a2240bbac1475a69df9199f3412b8abc22
SHA512 eae3c1d64c208a6f1a1192969f273976e62feadf0e1ef8e62cd5d67e1aa29861b82423741f4196b719ae04223fa6054e38bdc20b9a5e62d9fac771e3df0cb1ab
SSDEEP 96:dVbJ0d+/9PX02k7aoBD/+FfWhrHF7SSl8h4otop5hlDJB6gpGyv+yqOVuo0ODUO8:dVt0MPE2WaoJRhrliiU2bPlUEqRo0wUd
TLSH
T122C12A32686DD9B755F69996F0033A83DEBC516BA9A16E50E6E90F0C00EF1DC1383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f1366b5579034480716c533c8a55db958775ec6a5e846bd203b98c07edc6c1c3
MD5 afbf469e9da092d040ef53230ebf8be3
SHA1 98e4abcd65a1111adb6dfa3dff9797727ca7808b
SHA512 8ea94c2a9b95a63b426305b118a6f48983636609475b87297bfcf42473f957eab88edb92fba4341e29803cda43ed39620012dbd26aa0f20cee261597405faaac
SSDEEP 96:D6Q8v1VwrxMWezC1UJHYBbhywtaBG5BHK:D6Q8v7wrxMWEqQ4tcElXK
TLSH
T16E915AFBC3D8867E885156F4A7257E1ACD2D195983283C5688E8EF4FA3E1471E20139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3c6af0d4ee75c323e06a9fc039a374d2fc65bc4a8c9f61294e5826a29093ee25
MD5 a1175b54fdd5d3da6a98ecfaf6ce3641
SHA1 d04d5ac858b00851e673bf814235162009d2e32c
SHA512 7cbb1f0034eb5c2f995f81ae7fc92fd60de8846a0d92e8885fb95043dc525703e4b365a3e45da17af51cd0d2c33ef05adcb57a7ff6f160aa269c89e21e3e6f35
SSDEEP 192:FR1WLT3v78NvAPRp25EO94Hsb+WNnq8P+keQ3289lIeVyIsnAUgR:FR1WffYN6XCWwvPr2sR
TLSH
T1CC32B52EA950343B5DDFD22AF9217B57E2F9002275A42E84E6FC8E6C15DBDCC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8316df3503865960aa400bc39b554495dadcaef3b0cfbe96a9685df617467787
MD5 393472c37f36dd25990522d53b4bcf40
SHA1 c5bf5752b0595fef876dbb033d885f078b5e7b17
SHA512 0e3b2553424bb278b118e237cd26f2f0813abbdf71400b71184b5ed2ddfb337ff2152a56f3a46e1885e39feeed4ccec029bc87adce82817d971be341a7d44edf
SSDEEP 192:FR1WLT3v78NvjPRpr5EO94Hsb+WNnq8PUkeQ3289lIoVyIsnAUgE:FR1WffYNjX1WwvPt2SE
TLSH
T16B42C52EA950353B5DDBD26AF921BB57D2F9102271A42E80E6FC8E2C15EBDCC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 466cd43d0d23fc821de3e69c2a3e5bf132cb3dbebb252a897757892a70e9a1ed
MD5 7bfeb19557d95c21dacc814e586baa86
SHA1 8bd9326e6500ed5f015685c60b7f31697a16850e
SHA512 5f8469e8ffffeeb843577c4fe42ebd92e9131e00b8da30a25dcfa755dd8163cb451dc056a7e108cffec4472e3133b760b9dedee8bd2f42fd3fab3d7eaeca358d
SSDEEP 192:e+x4K6sK7KxkXqK4I40pUZNCgVLHrKHfFKslESWAXzKD/ru+ErUkKN91pqtS95ZW:/xjzK7KxkXqKf/pUZNCgVLH2HfgslyAV
TLSH
T18E32B727948D6A7B4FD8E90CDC136F8F6CB5029272680D2456FF9D0803E5BCE115A5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\f00175c4-32fc-4589-b20b-098376486684\index-dir\the-real-index
Size 1KB
SHA256 172d5b4f44ed8ffedb5e1760d303efadea3b603b341becde87b1ec922c9afb2b
MD5 175c923e60f5c5d300ae88c331f7fa62
SHA1 915813db10f1b96cbe7bdabe9d30f6d2d8e90104
SHA512 2a2abe173c399f0253f34d1675133495be6c4d5dde092b9c264888cc675e26f9eadd88b7c70829a771fc0e38470df99d81cda25b4a69fa971d62ca387130f43b
TLSH
T19431638CCCC06BCED8B062B76A5444B267F52C28FC0CC35191F8B56574127A95B572FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5919e7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\f00175c4-32fc-4589-b20b-098376486684\index-dir\the-real-index~RFe5919e7.TMP
Size 48B
SHA256 72bf63b6982afb630d5aa4b5fb608d689aeab1f366d5f324da70813e25b7bdf9
MD5 4dc21297dd970916295d435cecd95d27
SHA1 4019d137a9a3ac65009a3bd28e286e047e1e115a
SHA512 a6500bd4eb34b82a987676923b45772bd65193adcd09526642db9f9dfd67e4966c0984e95f7dc56e39bc9bbb150735cb235a616b6f5be81fe3329649ecbe880b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 189B
SHA256 9dc45a2f0c345acf95e52181370c73e8f6de19e83a04e825ea8c2c694ef1cf52
MD5 54a5e8202b6bf8e3a6f9c4ab9db04bfa
SHA1 e846232feda7cdd00f717015a3f0432eba6f4f82
SHA512 8d836d8f547f96ac2ecb111b1d7a5c4bfee8252139a824ea50617245df02d0ed2a79fda435802c1e19c65bc188e6534fc1fed1d7a7e129f498d24c46b11ab60b
TLSH
T174C0C080C3330C25235081104034140B0D3CCC11B4A8CFB4F41F7703287A302C963DF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 98B
SHA256 9addff3dd409d7206f51248aa88c02fd580adaffe224dc38b4eded515490217f
MD5 d37a1f76bb658ce13f5445d43f6cef83
SHA1 a6e9ab81998a0c793fce50d5f8b19aae577fd711
SHA512 86f043000033cbf6f0fc201819f25aaea56e761953bdacea1b501b4bdbeeb1683b9ba9a58a1824730f176c753d509f0b083d95618effc384c582f979ff1ba808
TLSH
T14CB012D0D1139E2503F8571A011810072D1AC0016038AE48F55C420709369110D93EF5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 100B
SHA256 f56391c0550a2089e5812a7b8e9b6ab83a7249225d1e6adf62597f6b760df820
MD5 fe92e56aa6ce5484211a2486adf06ae0
SHA1 551cc4658665c6518c365b43c36a9998ce0add17
SHA512 e14e292d22b209beed05dc3984aa251e6950277377d8c52204a7c416ebec8259bb14a07e9a5dd4f9dbfc4e3379959eb2917bb23d51b86c255d899d8de4d27d9c
TLSH
T1F1B01291E1139E2103F8531D011810072D1AC001603CEE88FD6C420706369114D93EF9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c733.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe58c733.TMP
Size 105B
SHA256 9a13339bbe49f804658512566217dd81aaea7d01cfcf6574e5e3228cf91151ba
MD5 818a8b947bf63bbb36df38cb5db04cd4
SHA1 7426d69f62d26944281aa7fec215ce4ede00592b
SHA512 850e6d77f798fabe2201683f37e1d5c336d4f812d763c3bce3354ed9fb43ca042f15af206efde8057537349c8ca5157b267d6233b159a943db672e896aa3cc96
TLSH
T1E0B01290D2235E2103E41216012811071D6ECC116438DE48F55E72031936A124E93EF5
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a58461954a64699bc549b35d1b04971cbd39bc361bfa064d40dc83caa2a983cb
MD5 7dfd894ce85db689ab397281d17541f4
SHA1 a080f399a26cea096581c06e9428698010c35bc4
SHA512 8b4827200c0458d57457a0f9c2832914ec0ee2c341a87d71ead094b871b5ae327cd8500906fc195418d8d827bd9abc2beac501b1f4caf3ce42a49b631bf50819
SSDEEP 96:dFbJ0d+/9PX02k7aoBD/+FfWhrHF7SSl8h4otop5hlDJB6gpGyv+y9OkSHsJRNCQ:dFt0MPE2WaoJRhrliiU2bPlUE9OkSHyx
TLSH
T126C1F771A82E9CAB48F66585F1032D478DB8616BB951BE58F9ED4F0810EB4DD1383933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2c1fe5b2d896dfd7cbd44816a97071ab72062bfa39b081913033f3fb4c54d886
MD5 990605d400ffb1fd043021fee0bfecee
SHA1 cff87e48ff4a707dbee71923e046de910d5551f0
SHA512 b612fb1eacc3e4698ac5b915e7ba0f3bd63fbeda5406aaa195a2cbc10ffd53ea65154ec6e6dd8b8529d775d2f212cb865822d9b9ab57201a1008f7fe586e85f4
SSDEEP 96:dVC0d+/9PX02k7aoBD/+FfWhrq+F7XRDotok5hGDJB6jGyv+w6DHsebElkfv4a:dVC0MPE2WaoJRhrq21DUDqPbi6DHvb+w
TLSH
T1F5A12A31687DD8BB99B599C5F5527A43CEBC611BF961BF81A6ED0F0C20EB0D81342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f2eeb50461a6bd6b66ff6c5abf2c515a9b731470cd83910bba8aaa5e8cf995a0
MD5 84aa290260a501738c605ec2dcdb161d
SHA1 21b41df8725fe42c485a66d167f076aa74ef1396
SHA512 1a0d5dc214576697ac3a59fce8cc99ddebebd49165edb6fd451bf8c62fa5731f2bc8302533acf3890a578c216bc3b5628688fdfdf47bc7a9b18a9b9734193a41
SSDEEP 96:dVC0d+/9PX02k7aoBD/+FfWhrHF7SSl8h4otop5hlDJB6gpGyv+yqOVuo0ODUO1y:dVC0MPE2WaoJRhrliiU2bPlUEqRo0wUd
TLSH
T166C12B32686DD9B755F69996F0033A83CEBC516BB9A16E54E6E90F0C10EF1DC1343523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c7d1212a6db7cccc87c564c10fae1363291daecc39ec77d0439e4385779f00f3
MD5 2dbcc7ef23add85d9fd14acc4be82544
SHA1 3b9ad0826e78ec06e159ee6a731c86dcc206a3e5
SHA512 baaec800ac59232027ea0e746ef5592ba2c9b6be8921883410b2f3a03e7da25d2a111d8afe89b971e3f11087d6107305630f8b15e1a114b39ef7d451f8036cbd
SSDEEP 96:dFbJ0d+/9PX02k7aoBD/+FfWhrHF7SSl8h4otop5hlDJB6gpGyv+yqOVuo0OD/Ob:dFt0MPE2WaoJRhrliiU2bPlUEqRo0w/a
TLSH
T11EC13A32686DD8B755F69696F0033A83DEBC516BA9A1AE40EAE90F0C10EF1DC1343533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download