8e36d710b19c6d3c5a04f955ec7b4dae38b9939970557d9c5172ed31edfd4d1b

Analysis

max time kernel
899s
max time network
888s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
massar-moutamadris-on-pc.html
Size 365KB
Sample260701-tpem4abw4y
SHA256 8e36d710b19c6d3c5a04f955ec7b4dae38b9939970557d9c5172ed31edfd4d1b
MD5 d5cabdf7afcc0e98e5a58d8630d7dac2
SHA1 779e545d42f577e95d50e8c8c066ca89cf5108a9
SHA512 7de792c7d77af14c3bb309cbded83dad224f253f2210dc8adaea3f7775314c47c60e6ba4e6488637e8de9c6a5f15affd261169b2a60276c7e0d91e9b85358a94
SSDEEP 3072:o+27rqHa5gRAkjs+5QXBXt7z7GoJNhjw/iDYNqYl4XuW2QbQtc:oVHqHa5gFsPz7GmNhjuiU0YlbQbX
TLSH
T1A8842A635771313850239AAAA6DF372C313DD02BD2025D9DFA7C561DCFD6A9903A228F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
57	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3900	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273961171696585"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 2784	5336	chrome.exe	88
PID 5336 wrote to memory of 2636	5336	chrome.exe	89
PID 5336 wrote to memory of 2636	5336	chrome.exe	89
PID 5336 wrote to memory of 3900	5336	chrome.exe	90
PID 5336 wrote to memory of 5988	5336	chrome.exe	92
PID 5336 wrote to memory of 5988	5336	chrome.exe	92
PID 5336 wrote to memory of 5532	5336	chrome.exe	93
PID 5336 wrote to memory of 5532	5336	chrome.exe	93
PID 5336 wrote to memory of 5760	5336	chrome.exe	94
PID 5336 wrote to memory of 5760	5336	chrome.exe	94
PID 5336 wrote to memory of 1508	5336	chrome.exe	96
PID 5336 wrote to memory of 5444	5336	chrome.exe	97
PID 5336 wrote to memory of 5644	5336	chrome.exe	98
PID 5336 wrote to memory of 5520	5336	chrome.exe	99
PID 5336 wrote to memory of 6128	5336	chrome.exe	101
PID 5336 wrote to memory of 6128	5336	chrome.exe	101
PID 5336 wrote to memory of 3620	5336	chrome.exe	102
PID 5336 wrote to memory of 3620	5336	chrome.exe	102
PID 5336 wrote to memory of 5068	5336	chrome.exe	104
PID 5336 wrote to memory of 5068	5336	chrome.exe	104
PID 5336 wrote to memory of 4748	5336	chrome.exe	105
PID 5336 wrote to memory of 4748	5336	chrome.exe	105
PID 5336 wrote to memory of 5596	5336	chrome.exe	107
PID 5336 wrote to memory of 5596	5336	chrome.exe	107
PID 5336 wrote to memory of 3544	5336	chrome.exe	108
PID 5336 wrote to memory of 3544	5336	chrome.exe	108
PID 5336 wrote to memory of 5012	5336	chrome.exe	109
PID 5336 wrote to memory of 4428	5336	chrome.exe	110
PID 5336 wrote to memory of 5012	5336	chrome.exe	109
PID 5336 wrote to memory of 4428	5336	chrome.exe	110
PID 5336 wrote to memory of 1904	5336	chrome.exe	111
PID 5336 wrote to memory of 2284	5336	chrome.exe	112
PID 5336 wrote to memory of 2284	5336	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\massar-moutamadris-on-pc.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6d81c728,0x7fff6d81c734,0x7fff6d81c740
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,2188866861739756479,13575060819411745418,262144 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,353048945387862920,6524970625864709503,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,6417838845361661903,5913076095576340078,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,8769899770204032356,9376756200433124602,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,17804408330359782945,8785448252940509018,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,17049143077568612135,10267965330136785458,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,17714914445111825590,13178787951700522121,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,8107483789780500755,6646445815610374361,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,8962068538663899522,7565138154854130453,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5580,i,9407893995619413620,17692323326099296381,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5664,i,16301640193682036237,15290266576437391519,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5620,i,5618039404292094362,15853391110114212077,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5972,i,10384007328462836430,11204513454203337129,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4720,i,8760851931344047712,15193887594822022447,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4840,i,1472664717647051459,15657035823971471942,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6100,i,10417146175225684879,5495801271820511733,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5876,i,8621449140886740888,16092640926133532490,2097152 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5100,i,14386099936634605606,10867155569201403628,262144 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,15881619046483511285,12172902788060827208,524288 --field-trial-handle=1912,i,11917489195980031131,12590536725432893695,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:2284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5644

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e12935a60f60b134fb59798a56ccf09407d62d210518d9319a2d567fe0fb5a48
MD5 141b332c240d28cbf843ef9647cec183
SHA1 6b742a2326b392d8c7287a4114aaa64b46cb3b93
SHA512 2f88e66abd5fa8a9411571ea522a3e8a5f85957a0629f7e7eb4eb1d1415a7aa734842fcd603b7898407c1f3e16ada393834cf976d24fcd476dc27999b890cc97
SSDEEP 96:DmcletsQc7L/7AZrsZk8B6ix/5ZrwR+sJgLCBZ/:DmcletsQc7z7AZrsZk8B6+5ZrwR+sJeO
TLSH
T1DFB18EBBC3E4877E891151F5AB262A2ACD1D155B436C3C56C9F46F0F63E28B0E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 9cd18758c149f3f4ae9fcf06c69bdaeee313bfc481361bad5e164701413f01d0
MD5 be17f5fa0c84f19f9ccc9ab1f3bc0e9a
SHA1 d50736b7323e7ff4916902ae2cdd46058caae9fa
SHA512 d9eda467301bdafa2d18dbf7491adca8729d97c437d97cf597b2ee9f87095c700cfe4283cda8b78d7a4cdbfbfb28ee1cfa85ac1caed1152dba3e6991b12e06bf
SSDEEP 192:DmceUetsQc7z7AZrE8B6+5Zy+sJe2ZpZtg7+BwXK:DmceUetsQc7z7AZrE8B6+5Zy+sJe2ZpJ
TLSH
T1A4D18FBBC3E4477D851152F5AB152E2BCD1D151A432C3C56C9E5AF0F63E28B0E20169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 cf7ce392e744054eefe3b9f5d396d6480922ae35411b60059090f49055addc67
MD5 b18aa7d237a839467573ecb31e8e2022
SHA1 3506a9ac02d1339e9bdc3426ff1285ddd5ea955a
SHA512 91cb5c080ad4387925c29fdf49255bff6052f3adb371c023996199e85f056869167eb1b0ab2c00fe6799616f86c67c68341b6385e87175f7b23dae32f26f67e0
SSDEEP 192:DJbem8etsQc7z7AZrE8B6+5Zy+sJG2ZpZtg7kwRIK:DJbem8etsQc7z7AZrE8B6+5Zy+sJG2Zg
TLSH
T1BBD19EBBC3E4477E891152F5AB266E2ACD1D151B432C3C56C9F46E1B63E28B0E20169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 81469892263a9afb1fc56db91fc38c89df0ebe8aa2a2be987d5ce6f9422ddda4
MD5 d68c7b8f92d83a5fe234287df1429be7
SHA1 d8a69364ae23c86ca65802f9f8b5bf09e612e3ef
SHA512 f83dff874b1490226fcf9ee09e5ced0c1bc92396175852bf37ae319179ea17bdc240ac2a8def8e085817ae33d4ca0a9e6892c13aeeb0af1c64c08634eb5799ee
SSDEEP 192:DmcerDetsQc7z7AZrE8B6+5Zy+sJe2ZpZtg7nwoTl:DmcerDetsQc7z7AZrE8B6+5Zy+sJe2ZE
TLSH
T1CCD19EBBC3E4477E851152F5AB256E2ACD1D051A432C3C56C9E5AF0F63E28B0E20169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 05500fc13a1b7751b0b2d99bc3ea767a3a41bc52695e2c4f18723cebaa42f870
MD5 36f023db16c6c6165cd9e9932e53be67
SHA1 c6db68320f97a81f61546de5e4ee430ebfbf5025
SHA512 eb6eb4f5d77d91b40808b06461b30fc8072239f2605ad6e52e96d499e6759d81fd47a0f094f9662b5efb947866e32ea0ebc9f92edbf8bb8c7dbb5a63b8e1d1ae
TLSH
T138119297D5BEB42B103D48AB0D47BC06547A6430475278F5DBA7925CB0924E3170E87B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 616b761096e3d61844026b334de3eda18acd20930ebba564bd09b51a9eb98597
MD5 1e0312541385d49c17b7fe39fa0a0e62
SHA1 2e3a3f4cb49d6f2bf203266c2599c289e9e0f7bf
SHA512 1fbd31c86238053f38454daa9cf8785d561049b12e958e74c294a8c26f3beec7781465e872383010223cbd6a95e9b3ff51f9c3e5725268921260db8d8092f1ae
SSDEEP 192:tRVj3Y+z3qYsT3Fv7+mvAPRp2jVw9WHsb+WNnVJZP5U9QepkVyIsnAUgR:tRdzdcF6Xt4w9PRR
TLSH
T1DE22B62EAE6464BB5CCBD219FA617753E3F5103265D01E84EAFC8A2C12E7DCC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9ffa835d2d29798414592185383d54cd0bbd4bbbcc9bf74a94adf4fc6e82047f
MD5 7b8d613fb69473821315e66cf1a37e7f
SHA1 7ae1523b26974b3e63e34c2c45a49661d25881e2
SHA512 755780209f02ffda18e4faabcd8b142b56dbf93b6a693e47c349426de11a1bd23c840e4a59ca4f4137b63470a1757421e5df26ed60ab74bfd9265b19e1901553
SSDEEP 192:tRVj3Y+z3qYsT3Fv7+mvvGPRpWNjVw9WHsb+WNnVJZP5i9QeSkVyIsnAUgR:tRdzdcFYXX4w9PSR
TLSH
T19832B72FAD5465BB5CCBD219F9617B53E3F5203265901E84EAFC8A2C12E7DCC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 3abc2ac4a2c5da65126576d58c56c0d597ad898ce7a2078d8f8edc661d9b9ec4
MD5 c064cd50f7204606c0b20ad0bdbc1f8c
SHA1 f22a8e12fb666315235314fb8d6d8646a0b87770
SHA512 322d858ac4d33d2725789b604cbaf2bb82f9cfceb24011b16785be10b708a0ca150e8bc8d3dfa442f66d87dbd51c1521f9406f5dc039b4253c2d6de1563bdde4
SSDEEP 192:e8j4K6867KxkXqK4I40pUZNCgVLHrKHfFKslEdUCXzKD/hg+ErUkKN95b1ee8Z/B:Vjjz67KxkXqKf/pUZNCgVLH2HfgslPC/
TLSH
T1A332E927988D5E7F4FECD50CDC136F8BACB5015666680D2856FB9C0803A578E124A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2586f468f934775802b28372f5e63c6705212f1a60f62130bf1306895a587b2b
MD5 86af3cb2173141d52ececca6a535b31d
SHA1 6fa6ecf338ae5fafd1813280de3177f57b6ddb86
SHA512 6c7745997347e658ca813d4e948785476e03696d4310bb3993d113f6eb75dbba7caf26e98dc5dc68595e46f567a0afbe12c77095460cd5d708572ca4c196ab4f
TLSH
T141A00210725105C6D0159A701491A281B3597C345931074A61F5185BCC542C04301005
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 523447fcb1c739d98b688afa4ef9addc1683808f72cfe7623c7a0712c0f28416
MD5 cde5ff495293c086b877a68572d11815
SHA1 c606c7a3958b5fd9c3665e675cac79f9d7477539
SHA512 c9a44139c860ef733ffdd94f8e0505da75e19465c54441dd7e9c02e098da35ca106dffa11d22f7632b5edc4774d8f1b67b32369bcb5407ac026211c33992f58e
SSDEEP 96:JbJ6rd+FKJXPXDJAKWTeVslfnbjLyHslSl8h4otop5VeCDV0B6h6Gyvy2qyNsuiF:Jt6PJX/dAeyt/LyQiU2VpV4EbcPsui2c
TLSH
T139B1097268AD9CB355F3E145B1432F03CEB520979954AF98DAE90B0C02EB4EC1347523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f7e398627adef7139c6697eba3e5f010cf9087e3a5add16aeeffd289ce926ddc
MD5 e18d39fb92e2739232421eb7c8575e7c
SHA1 826cab6550d611b07c85b8dedc2feb3ede14aa89
SHA512 fe657d5edd7523647f86b6e4613598c34c4782b9775e0a25ed54db92ff43311f2633e6ddf3c9ea76ec3668a29faedfdf492b73b79af3185eea536587f5f22020
SSDEEP 96:JbJ6rd+FKJXPXDJAKWTeVslfnbjLyHslSl8h4otop5VeCDV0B6h6Gyvy2qPNJuig:Jt6PJX/dAeyt/LyQiU2VpV4Ebc+Jui2t
TLSH
T1F6C1E972A8AD9CBB49F2E445B1032E03CE69609B6958BE58EDED4F0C02E74EC5343573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a320dcf35327a22ce7d18557bdce5db06ab79ab36aad1544dc5c2589c2917321
MD5 e75f3122f6d91a36aa175e8fe287b9c2
SHA1 f242d24fa89cb7876ef230e6f7972be7eb6cba35
SHA512 7ed80dd490923e3bf51448c982c2296831da8933fc194422d6d5e47cc9a0767df808bd15f3646135917245e77e257a4a3f80265a3f6467505d39889d758420c4
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbjLyHslSl8h4otop5VeCDV0B6h6Gyvy2MxPjFNne:JC6PJX/dAeyt/LyQiU2VpV4EbcM9nuiw
TLSH
T13CC10832B8AC6CB349F2E449F4032F03CE7561979964AE98DAEA0F0C02F74E81347527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7d47abcf695dc542fc3faf44821739f039327a6396e07095964b6987add306d7
MD5 82fdd879a89883ecbbefbf2ab8add52b
SHA1 414d75e43a4d2806da222570f43adae42f72d0ab
SHA512 6e930a5b0ae42d96e3650fb5bb94aa5fba4534eb239e286d0a3a907023e91b4aeadff34a2c8990d40a89993969fdb99d2f4d8fe57891f8ea5e8a2ea982879536
SSDEEP 96:JbJ6rd+FKJXPXDJAKWTeVslfnbjLyHslSl8h4otop5VeCDV0B6h6Gyvy2MxPjFNe:Jt6PJX/dAeyt/LyQiU2VpV4EbcM9nuiw
TLSH
T11AC10872B8AD6CB349F2E449F5032F03CE7561979964AE989AE94F0C02F74EC1347527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 89df02c34b1633b82c7eab10ef265bb68ef965ae2633b45ab522467b07864ca1
MD5 94df89b80254c018dc8c0dac3be1adef
SHA1 38c6960ac872d427e76bee5d5e0af7ed9e9b75b2
SHA512 c698f3b466ed589dcabafb17d2aac4afe37550c9a6eb2b787785aff49e7b158fb3a477f51972b1d125f7907512948828741234bb28bca1117fe8721d2cbaffbf
SSDEEP 192:Jt6PJX/dAeyt/LyQiU2VpV4Ebc+uui2gu8QwG:Jt0Ty5PXn+fgu8QwG
TLSH
T17CD1EA7298AD9CB759F2E445B1432E03CD696097A958BE58EDED0F0C02E74EC5383573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 86aebbca341f2256a883536c4786f00c30515cfa6fabecc75eee132483a999c4
MD5 6972e865c4bdae62d14ce77de47b90bb
SHA1 217b228aef7dc3017f11fec24b55c82761d8a6a5
SHA512 e47035be312a8f833bb9035f98dfce7751fa11344e4f3a6ec06a0ff1396b0b3b002a00ceeb33bab88d7571dddad434a94cf3c421c996812aed04a7946b5fc4ef
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbj5EsVRDotok5VexDV0B6ydGyvyv1Pi2ibmjiv4a:JC6PJX/dAeyt/3DUDVAV4Fw7Pi2ibqM
TLSH
T1B4A1F972686C5DB358F6D189B9932F03CF6521979961EF8899EC4B1C06EB4E80343973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download