hxxps://us[.]content[.]exclaimer[.]net/?url=https%3A%2F%2Fsecure-web[.]cisco[.]com%2F1dxCJYXUcPXHrJbzdPHyYwkyXB8TSWfAKpL3Z_DeSJ8XwA6hpYQ4k1hk1866B4xpR4eUPR0o0bW4O3KPvUWTN7dGif6kzpgkSuHm01aqAPApaB8Gz0ecGVmH2f3jo965C9o6xXM07z9hdETAnT7gv7pKLXgYROqIk51flflfGu7yzzQ--nfCH3_CezqYRhVdUjlTq9XtAPNEbT2n8N1SxfevaT64YrodOOL3b9swAPrjBHDNxHctQ7xfQNwcupZ_PvDx2Apf7Hx-9_Q-16cMX-GffxLjWwBkLWUJ0G9NP3REBUrRelzJ7lCB4F6NjhblMbyEzx7WcftTQPzXEV8Lxp06GIEVlDcvJGz1OKJUVZCjohDQsvmaera2INGmVhqmIuUiQcX0ECet3i4geTbKYq4dYNEMlQ3H_VmHWIUdClJyn96I-N4CXexPehZ3VoTMGYtwSVyhLiUuAMEekQ8ztZHqngz6mNhfbT-M0X9xHYjA%2Fhttps%253A%252F%252Fjagdambaalcobev[.]com%252Fwroks&tenantid=8dVLIf1cEfCNTAANOh1Shg&templateid=8067d7b9d0fdf011832e000d3a1d5b2d&excomponentid=u83pNPiq0zqlY_7b5baT_bNDnmkUtfd_FgVa3JFXsmo&excomponenttype=Link&signature=ZFWiPUFUhghfEN5Lhyh0AsDap49RKsOk0-zGxb_nt7j2ooCAQfxhN-6bB6rzsSrD4Q4adwi5j3osGKZwRXn87kcxTi3xGJ-PZP0ThKdnnFJXZ7gbZnbzerypaGWV_cuj46kZhf5yfv0fG5T8zo6NPhAiZmahosR3PzHgfZrK7QhRCOvIZGo55xGaAnGT7wxOryljwOfE4VzFdnKpCmiwa5pjDuc4V310pyfbypw2I3MZePxmh5sWjKry_DcfOE7PaUX9i0KA4ed4xMIsUynabsvepAn35_2Qgmgbnc_2ZlBcr_2a8NdmIlF6r7LEqyNadaQjbvqV1acEazXrk8EtBg&v=1&imprintMessageId=9caa945c-c195-4d0a-91c7-896af74538f5

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
72s
max time network
74s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us.content.exclaimer.net/?url=https%3A%2F%2Fsecure-web.cisco.com%2F1dxCJYXUcPXHrJbzdPHyYwkyXB8TSWfAKpL3Z_DeSJ8XwA6hpYQ4k1hk1866B4xpR4eUPR0o0bW4O3KPvUWTN7dGif6kzpgkSuHm01aqAPApaB8Gz0ecGVmH2f3jo965C9o6xXM07z9hdETAnT7gv7pKLXgYROqIk51flflfGu7yzzQ--nfCH3_CezqYRhVdUjlTq9XtAPNEbT2n8N1SxfevaT64YrodOOL3b9swAPrjBHDNxHctQ7xfQNwcupZ_PvDx2Apf7Hx-9_Q-16cMX-GffxLjWwBkLWUJ0G9NP3REBUrRelzJ7lCB4F6NjhblMbyEzx7WcftTQPzXEV8Lxp06GIEVlDcvJGz1OKJUVZCjohDQsvmaera2INGmVhqmIuUiQcX0ECet3i4geTbKYq4dYNEMlQ3H_VmHWIUdClJyn96I-N4CXexPehZ3VoTMGYtwSVyhLiUuAMEekQ8ztZHqngz6mNhfbT-M0X9xHYjA%2Fhttps%253A%252F%252Fjagdambaalcobev.com%252Fwroks&tenantid=8dVLIf1cEfCNTAANOh1Shg&templateid=8067d7b9d0fdf011832e000d3a1d5b2d&excomponentid=u83pNPiq0zqlY_7b5baT_bNDnmkUtfd_FgVa3JFXsmo&excomponenttype=Link&signature=ZFWiPUFUhghfEN5Lhyh0AsDap49RKsOk0-zGxb_nt7j2ooCAQfxhN-6bB6rzsSrD4Q4adwi5j3osGKZwRXn87kcxTi3xGJ-PZP0ThKdnnFJXZ7gbZnbzerypaGWV_cuj46kZhf5yfv0fG5T8zo6NPhAiZmahosR3PzHgfZrK7QhRCOvIZGo55xGaAnGT7wxOryljwOfE4VzFdnKpCmiwa5pjDuc4V310pyfbypw2I3MZePxmh5sWjKry_DcfOE7PaUX9i0KA4ed4xMIsUynabsvepAn35_2Qgmgbnc_2ZlBcr_2a8NdmIlF6r7LEqyNadaQjbvqV1acEazXrk8EtBg&v=1&imprintMessageId=9caa945c-c195-4d0a-91c7-896af74538f5
Sample260701-atfleabt9q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3908	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273394224470957"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe
Token: SeShutdownPrivilege	5320	chrome.exe
Token: SeCreatePagefilePrivilege	5320	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe
5320	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 5836	5320	chrome.exe	88
PID 5320 wrote to memory of 1184	5320	chrome.exe	89
PID 5320 wrote to memory of 1184	5320	chrome.exe	89
PID 5320 wrote to memory of 3908	5320	chrome.exe	90
PID 5320 wrote to memory of 5248	5320	chrome.exe	92
PID 5320 wrote to memory of 5248	5320	chrome.exe	92
PID 5320 wrote to memory of 5388	5320	chrome.exe	93
PID 5320 wrote to memory of 5388	5320	chrome.exe	93
PID 5320 wrote to memory of 4744	5320	chrome.exe	94
PID 5320 wrote to memory of 4744	5320	chrome.exe	94
PID 5320 wrote to memory of 5400	5320	chrome.exe	95
PID 5320 wrote to memory of 5400	5320	chrome.exe	95
PID 5320 wrote to memory of 2648	5320	chrome.exe	96
PID 5320 wrote to memory of 2648	5320	chrome.exe	96
PID 5320 wrote to memory of 4164	5320	chrome.exe	97
PID 5320 wrote to memory of 4732	5320	chrome.exe	99
PID 5320 wrote to memory of 3612	5320	chrome.exe	98
PID 5320 wrote to memory of 4732	5320	chrome.exe	99
PID 5320 wrote to memory of 3612	5320	chrome.exe	98
PID 5320 wrote to memory of 1288	5320	chrome.exe	103
PID 5320 wrote to memory of 1356	5320	chrome.exe	104
PID 5320 wrote to memory of 1288	5320	chrome.exe	103
PID 5320 wrote to memory of 1356	5320	chrome.exe	104
PID 5320 wrote to memory of 2016	5320	chrome.exe	105
PID 5320 wrote to memory of 2016	5320	chrome.exe	105
PID 5320 wrote to memory of 3988	5320	chrome.exe	106
PID 5320 wrote to memory of 3988	5320	chrome.exe	106
PID 5320 wrote to memory of 2908	5320	chrome.exe	107
PID 5320 wrote to memory of 2908	5320	chrome.exe	107
PID 5320 wrote to memory of 3368	5320	chrome.exe	108
PID 5320 wrote to memory of 3368	5320	chrome.exe	108
PID 5320 wrote to memory of 2208	5320	chrome.exe	109
PID 5320 wrote to memory of 2208	5320	chrome.exe	109
PID 5320 wrote to memory of 5828	5320	chrome.exe	111
PID 5320 wrote to memory of 3960	5320	chrome.exe	112
PID 5320 wrote to memory of 3956	5320	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us.content.exclaimer.net/?url=https%3A%2F%2Fsecure-web.cisco.com%2F1dxCJYXUcPXHrJbzdPHyYwkyXB8TSWfAKpL3Z_DeSJ8XwA6hpYQ4k1hk1866B4xpR4eUPR0o0bW4O3KPvUWTN7dGif6kzpgkSuHm01aqAPApaB8Gz0ecGVmH2f3jo965C9o6xXM07z9hdETAnT7gv7pKLXgYROqIk51flflfGu7yzzQ--nfCH3_CezqYRhVdUjlTq9XtAPNEbT2n8N1SxfevaT64YrodOOL3b9swAPrjBHDNxHctQ7xfQNwcupZ_PvDx2Apf7Hx-9_Q-16cMX-GffxLjWwBkLWUJ0G9NP3REBUrRelzJ7lCB4F6NjhblMbyEzx7WcftTQPzXEV8Lxp06GIEVlDcvJGz1OKJUVZCjohDQsvmaera2INGmVhqmIuUiQcX0ECet3i4geTbKYq4dYNEMlQ3H_VmHWIUdClJyn96I-N4CXexPehZ3VoTMGYtwSVyhLiUuAMEekQ8ztZHqngz6mNhfbT-M0X9xHYjA%2Fhttps%253A%252F%252Fjagdambaalcobev.com%252Fwroks&tenantid=8dVLIf1cEfCNTAANOh1Shg&templateid=8067d7b9d0fdf011832e000d3a1d5b2d&excomponentid=u83pNPiq0zqlY_7b5baT_bNDnmkUtfd_FgVa3JFXsmo&excomponenttype=Link&signature=ZFWiPUFUhghfEN5Lhyh0AsDap49RKsOk0-zGxb_nt7j2ooCAQfxhN-6bB6rzsSrD4Q4adwi5j3osGKZwRXn87kcxTi3xGJ-PZP0ThKdnnFJXZ7gbZnbzerypaGWV_cuj46kZhf5yfv0fG5T8zo6NPhAiZmahosR3PzHgfZrK7QhRCOvIZGo55xGaAnGT7wxOryljwOfE4VzFdnKpCmiwa5pjDuc4V310pyfbypw2I3MZePxmh5sWjKry_DcfOE7PaUX9i0KA4ed4xMIsUynabsvepAn35_2Qgmgbnc_2ZlBcr_2a8NdmIlF6r7LEqyNadaQjbvqV1acEazXrk8EtBg&v=1&imprintMessageId=9caa945c-c195-4d0a-91c7-896af74538f5
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffec663c728,0x7ffec663c734,0x7ffec663c740
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,6120268747246728712,17740591676823289254,262144 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6185471754948291570,6468201293671809666,524288 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,13595271515262978893,18225006262571667560,524288 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,10074327203821681261,4121500548289080216,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,10405269314105274401,4315289912373776176,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,3852592339945365587,11266035000593833110,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3440,i,9927958478807481437,8681907735628182436,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,10621565227273064177,13310952842653743414,524288 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5612,i,9014781860445498173,10395065745274192137,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5584,i,4451467513944142513,16950118413722648257,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,1726922729274467234,7515136277703147548,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5780,i,10513912845184301526,15511240249119574346,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5852,i,1002569793159503505,8576322858774954894,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3912,i,5096116904078050146,7494436216424883353,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3388,i,2834453441519943411,9086282937993381288,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5756,i,16259239559007234679,9221831101326753113,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3196,i,13938833726344476406,10454967981170285579,2097152 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,5783427580450109983,5123247652715355227,524288 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,14685917442220987108,16634922918211627608,524288 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,14600927016978776992,10817034846069735994,524288 --field-trial-handle=1912,i,11925955783104414106,6883694424185936983,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:3956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

21b3886c-70f2-4b2c-8d01-f564f3fadfef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\21b3886c-70f2-4b2c-8d01-f564f3fadfef.tmp
Size 4KB
SHA256 91c7a52f2a4910d63eb43c7f54e6e420b54e573c72a90257f9da494d064648a5
MD5 a89b289da83c29b16abafee16b85710b
SHA1 d6f04257eab861d844e520ffdbf89505cc1d6020
SHA512 da362d2997583a3dea013fa5a356393f791ddda158e45efedac95a395896f116a6246fd7b69ba39ea6c2e2633d375b44bd0c81090e58f761c0a4bfcd2a816213
SSDEEP 48:YALlFUVGhiDOPDJWbFgsyRspXLssfoKsHfsloss7y0Gs1iVNusUFUSsU6Ds0CMsQ:DFfg0kbF6etsQc7oVN+FD6dCZqbJWK
TLSH
T178A17DF7C7E88A7C8D1556F4AB152E1ECD2D1A2453183C2B89E89F4FA3E2471D201B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d57484e38d708f2e51ebb024a1ac61c806e82d406faaaafce4c56748fab2ca42
MD5 4026eede5eef1f78687afeeffc6acfef
SHA1 6e069f95589d8aceb4e2a3418ba5268a0ed7dc4e
SHA512 6d0ce75cbbf4269f3cc4283507406425a7e74c44ffa127cc98b97775628adfed1484452da87b7659e52b28e9a9473e7dc9d04810e0e68dc6dd9b271fffded372
TLSH
T140416AFBC3D8997D891196F8AB112E1ACD2D0918532C7C26C9D8AE0F53E1972E30015F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2f2a1cdaa5718d0233bb2ed2a9124de6bbee08dd6eb352622132d69e0547d17f
MD5 997ff942eaf8294262c70b17d346456c
SHA1 76d5d7f0220bcd5bc57cb4542f9053ceb38f0a73
SHA512 aaef6779ac599bed0a46b0e832a90663b0c67a50d4abcabac6ce0e9109b6b9e94d7175bcc0cbd5fd5d16a10ef656503c99e3309b83d5be6162889bed2ce4ae94
SSDEEP 192:tRVghYwp3qrsxFzv7+mvAPRp2cVRtVs9WHsb+WN/VRpVusqVar25FmfeE7VyIsn6:tRgf6eF6Xr44wjZl2QR
TLSH
T17132B82FAD2425BB5CDBD21AF9617757E3F5202265D02E84EAFC8A3C12D79CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eaff9474e6b1cddf0d05d9799a869a9cd76d4efc6e30ed44cdf86953dcf2a709
MD5 caed4a06120099fd54249f0ebab5e419
SHA1 de09ab5ee9cc07078debc095b5780b1664db8a39
SHA512 842f10440b8ab029982823a52a573c22f4a12b2ddaf8680aa60c08e5ad1ee9ce56674751a8de14b5a506f7c51cc37642f1362c974ff8bcd967125110ec0b8eb5
SSDEEP 192:tRVghYwp3qrsxqzv7+mvAPRp2cVRvVDVs9WHsb+WNsVVVRpVusqVar25KmfeL7Vo:tRgf6vF6Xrk4wUZl2CE
TLSH
T12D42D91FAD2425BB5CDBD21AF961BB57E3F1202265D02E84EAFDCA2C12D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2225f8152cb47b0d6996e5b9bc4bdb4eee91c35f50aae1c7008f1623dbb528fd
MD5 1ac6c525e757880e7b11a4c938f02e94
SHA1 427a9757890a9c3530eeebd8fc480559f964d6a8
SHA512 5e8334ff1daa80b966cf45c2d5ac16d21555bf0a48ced8f38ae63f634f8cb35619ab04c7307d02758621880b308096a931747ac1f9a4ca5952e768d45ccdce64
SSDEEP 192:tRVghYwp3qrsxEzv7+mvv7PRpWOcVRvVDVs9WHsb+WNsVVVRpVusqVar25+mfeZq:tRgf6pFDXqk4wUZl2mE
TLSH
T10C42C91FAD2425BB5CDBD219F961BB67E2F5203265D01E84EAFDCA2C12D7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 3abc2ac4a2c5da65126576d58c56c0d597ad898ce7a2078d8f8edc661d9b9ec4
MD5 c064cd50f7204606c0b20ad0bdbc1f8c
SHA1 f22a8e12fb666315235314fb8d6d8646a0b87770
SHA512 322d858ac4d33d2725789b604cbaf2bb82f9cfceb24011b16785be10b708a0ca150e8bc8d3dfa442f66d87dbd51c1521f9406f5dc039b4253c2d6de1563bdde4
SSDEEP 192:e8j4K6867KxkXqK4I40pUZNCgVLHrKHfFKslEdUCXzKD/hg+ErUkKN95b1ee8Z/B:Vjjz67KxkXqKf/pUZNCgVLH2HfgslPC/
TLSH
T1A332E927988D5E7F4FECD50CDC136F8BACB5015666680D2856FB9C0803A578E124A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 51KB
SHA256 8a8a2ef7317cc5288b1d75bcd34de2ae68affca8cb37bead73aaffb5c5169ae9
MD5 8e3664a0d2da8041670d9e26c112a52a
SHA1 7eeb906982dd413e2b4907056c1faa2ce9185c2d
SHA512 869c1d263f3ba77eabbb293692af357c7409fef5ddf527ed16b3b77a0080c646a99b477f1470a8e87398497d52c5b61717ec75177724d7a61777be252ae10fbb
SSDEEP 768:/0TlRPfFjGxBfhxgPBBMM8PAegtlG3zia+y4bg5I+GErDW6PCKzvv5+npYV4/uWM:sTvfBGxRWBf84eMCX6lMuO930gQuME
TLSH
T18E33F1334D3E9E9E6CF5B5CDF0830E168EA01169907EBE9185D41B4C46D938E2653BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3ddd13e51df681755020286ccf3463c2ca86097f1d1ecd01c082671e6c5e01d6
MD5 d89f156ac9fa527c90ff9597ecbce871
SHA1 56df3b1806dc0908a43b17d77864e585bf8f0653
SHA512 b829513089115b5c74dcb30799b5a48b41f13f1760d6d6b9043f88dc5b9935520f18929627b5017cec013a5ab2706f9b94e3f1f8cbba71d807d543e14339f644
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbjLWJWIsaSl8h4otop5VWzCDVW3B6hW/Gyvy2Mx4:JC6PJX/dAeyt/L29iU2VBV0E5cMnsuiX
TLSH
T1FEC12A72786D6CB358F3E54AB4032F03CEB56197A964AE58DAE90F0C02E70EC1347566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b2c805e0a5d2ecd09c751bb55130d557c8c0aede023abda0621bb2c8b0cbfa04
MD5 525b021f72a073be5acc948db85eb97e
SHA1 b49d8c00045b1e6a56f7b9fb2432695f0a285e87
SHA512 75856df93bffeb8f3851d4b4d66a504497b035194eba5e782a100e2ccf73bc82a5d85df12fbf54fb0e3cfd7b03fd970e4bf51802ea7f518c016ee401f809dc3b
SSDEEP 96:JbJ6rd+FKJXPXDJAKWTeVslfnbjLWJWIsaSl8h4otop5VWzCDVW3B6hW/Gyvy2Mb:Jt6PJX/dAeyt/L29iU2VBV0E5cMGsuiX
TLSH
T1A8C12A72786D6CB358F3E54AB5032F03CEB561979964AE68DAED0F0C02E70EC2347562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ed52c304aec9d2160ffde3adf5d1569684b22dbcbad54400a8cc74501842ce5e
MD5 ac7c7db2cdfe526e6827a0bc3ff68354
SHA1 c8046ec29032e0ace9c6a4f900062655f8aeaaae
SHA512 7b9b0351a39ad3e16f644a782e99e9345597b0a2b1a9eb5480c8faaa17384330aacbf7bb48db8013da2c9900f8fb16eb384a06a39f920833de3acc51d201de60
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbj5EsVRDotok5VWzxDVW3B6ydGyvyv1PiWBibmjM:JC6PJX/dAeyt/3DUDVIV0Fw7PieibqM
TLSH
T1E6A11972686C5DB358B2D589B9832F03CF652197A961EF8899EC4B1C05EB4E80347973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download